PT-2021-16909 · Unknown · Django-Wiki
Published
2021-11-23
·
Updated
2021-12-02
·
CVE-2021-25986
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Django-wiki versions 0.0.20 through 0.7.8
Description
The issue concerns Stored Cross-Site Scripting (XSS) in the Notifications Section. An attacker with edit page access can inject a JavaScript payload in the
title field. When a victim receives a notification about changes, the payload in the notification panel renders and loads external JavaScript.Recommendations
For Django-wiki versions 0.0.20 through 0.7.8, consider disabling the editing functionality for pages until a patch is available to prevent exploitation. Restrict access to the Notifications Section to minimize the risk of payload rendering. Avoid using the
title field in notifications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Django-Wiki