4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.01 Low
EPSS
Percentile
84.0%
Severity: Medium
Date : 2019-06-04
CVE-ID : CVE-2019-12308
Package : python2-django
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-970
The package python2-django before version 1.11.21-1 is vulnerable to
cross-site scripting.
Upgrade to 1.11.21-1.
The problem has been fixed upstream in version 1.11.21.
None.
The clickable “Current URL” link generated by AdminURLFieldWidget
displayed the provided value without validating it as a safe URL. Thus,
an unvalidated value stored in the database, or a value provided as a
URL query parameter payload, could result in an clickable JavaScript
link.
AdminURLFieldWidget now validates the provided value using URLValidator
before displaying the clickable link. You may customise the validator
by passing a validator_class kwarg to AdminURLFieldWidget.init(),
e.g. when using ModelAdmin.formfield_overrides.
A remote attacker is able to execute javascript and create html content
in the admin view.
https://www.djangoproject.com/weblog/2019/jun/03/security-releases/
https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673
https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b
https://security.archlinux.org/CVE-2019-12308
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | python2-django | < 1.11.21-1 | UNKNOWN |
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.01 Low
EPSS
Percentile
84.0%