PT-2008-3793 · Django · Django

Published 2008-05-23 · Updated 2022-05-01 · CVE-2008-2302

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: Django versions 0.91 through 0.91.1 Django versions 0.95 through 0.95.2 Django versions 0.96 through 0.96.1

Description: A cross-site scripting (XSS) issue exists in the login form of the administration application. This allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

Recommendations: For Django versions 0.91 through 0.91.1, update to version 0.91.2 or later. For Django versions 0.95 through 0.95.2, update to version 0.95.3 or later. For Django versions 0.96 through 0.96.1, update to version 0.96.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2302

GHSA-54QJ-48VX-CR9F

PYSEC-2008-1

Affected Products

Django

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2008-2302 · Security Note
• http://djangoproject.com/weblog/2008/may/14/security · Patch
• http://secunia.com/advisories/30250 · Vendor Advisory
• http://securityfocus.com/bid/29209 · Patch
• https://security-tracker.debian.org/tracker/CVE-2008-2302 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2302 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-2302 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2008-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-54qj-48vx-cr9f · Vendor Advisory
• https://github.com/django/django · Note
• https://github.com/django/django/commit/6e657e2c404a96e744748209e896d8a69c15fdf2 · Note
• https://github.com/django/django/commit/50ce7fb57d79e8940ccf6e2781f2f01df029b5c5 · Note
• https://github.com/django/django/commit/7791e5c050cebf86d868c5dab7092185b125fdc9 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-1.yaml · Note
• https://web.archive.org/web/20081012011038/http://secunia.com/advisories/30250 · Note