PT-2008-3793 · Django · Django

Publicado 2008-05-23 · Atualizado 2022-05-01 · CVE-2008-2302

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: Django versions 0.91 through 0.91.1 Django versions 0.95 through 0.95.2 Django versions 0.96 through 0.96.1

Description: A cross-site scripting (XSS) issue exists in the login form of the administration application. This allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

Recommendations: For Django versions 0.91 through 0.91.1, update to version 0.91.2 or later. For Django versions 0.95 through 0.95.2, update to version 0.95.3 or later. For Django versions 0.96 through 0.96.1, update to version 0.96.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2302

GHSA-54QJ-48VX-CR9F

PYSEC-2008-1

Produtos afetados

Django

Referências · 22

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/6e657e2c404a96e744748209e896d8a69c15fdf2 · Nota
• https://github.com/django/django/commit/50ce7fb57d79e8940ccf6e2781f2f01df029b5c5 · Nota
• https://github.com/django/django/commit/7791e5c050cebf86d868c5dab7092185b125fdc9 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-1.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2302 · Nota de Segurança
• https://web.archive.org/web/20081012011038/http://secunia.com/advisories/30250 · Nota
• http://vupen.com/english/advisories/2008/1618 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42396 · Nota
• http://djangoproject.com/weblog/2008/may/14/security · Correção
• http://secunia.com/advisories/30250 · Aviso do Fabricante
• https://web.archive.org/web/20080725022008/http://secunia.com/advisories/30291 · Nota
• https://web.archive.org/web/20200228153339/http://securityfocus.com/bid/29209 · Nota
• http://securityfocus.com/bid/29209 · Correção
• http://securitytracker.com/id?1020028 · Nota