PT-2022-1456 · Django+6 · Django+6
Keryn Knight
·
Published
2022-02-01
·
Updated
2026-01-03
·
CVE-2022-22818
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Django versions 2.2 before 2.2.27
Django versions 3.2 before 3.2.12
Django versions 4.0 before 4.0.2
Description
The
{% debug %} template tag in Django does not properly encode the current context, which may lead to XSS. This issue is related to the framework's failure to protect the web page structure, allowing a remote attacker to conduct a cross-site scripting attack.Recommendations
For Django versions 2.2 before 2.2.27, update to version 2.2.27 or later.
For Django versions 3.2 before 3.2.12, update to version 3.2.12 or later.
For Django versions 4.0 before 4.0.2, update to version 4.0.2 or later.
As a temporary workaround, consider disabling the
{% debug %} template tag until a patch is available.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Django
Linuxmint
Red Os
Rocky Linux
Ubuntu