PT-2023-12618 · Unknown · Django-Grappelli
Ksg97031
·
Publicado
2023-10-22
·
Atualizado
2024-01-11
·
CVE-2021-46898
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
django-grappelli versions prior to 2.15.2
Description
The issue arises from the
views/switch.py file in django-grappelli, which attempts to prevent external redirection by checking if a URL starts with /. However, this approach does not account for protocol-relative URLs, such as //example.com, making it vulnerable to attack.Recommendations
For versions prior to 2.15.2, update to version 2.15.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
views/switch.py file until a patch is available.Exploit
Correção
Open Redirect
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Django-Grappelli