PT-2019-1680 · Django Software Foundation+2 · Django+2

Published 2019-01-04 · Updated 2026-01-03 · CVE-2019-3498

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.11.x through 1.11.17 Django versions 2.0.x through 2.0.9 Django versions 2.1.x through 2.1.4

Description The issue is related to insufficient neutralization of special elements in output used by a downstream component. This can lead to content spoofing in a 404 error page if a user fails to recognize that a crafted URL has malicious content. The django.views.defaults.page not found() function is specifically affected.

Recommendations For Django versions 1.11.x through 1.11.17, update to version 1.11.18 or later. For Django versions 2.0.x through 2.0.9, update to version 2.0.10 or later. For Django versions 2.1.x through 2.1.4, update to version 2.1.5 or later.

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-99

CWE-20

Related Identifiers

ALT-PU-2019-2367

BDU:2019-01260

CVE-2019-3498

DLA-1629-1

DSA-4363-1

GHSA-337X-4Q8G-PRC5

MGASA-2019-0035

MGASA-2019-0040

OPENSUSE-SU-2024:11205-1

OPENSUSE-SU-2024:13887-1

OPENSUSE-SU-2024:14208-1

OPENSUSE-SU-2026:10005-1

PYSEC-2019-17

SUSE-RU-2020:2072-1

SUSE-SU-2019:0483-1

SUSE-SU-2019:1862-1

SUSE-SU-2019:3127-1

USN-3851-1

Affected Products

Alt Linux

Django

Ubuntu

References · 224

• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3851-1 · Vendor Advisory
• https://debian.org/security/2019/dsa-4363 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14208-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01260 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:1862-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0035 · Vendor Advisory
• https://djangoproject.com/weblog/2019/jan/04/security-releases · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2020:2072-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3498 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3851-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-3498 · Security Note