PT-2023-10329 · Unknown · Django-Ucamlookup

Published 2023-01-05 · Updated 2024-08-06 · CVE-2016-15010

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions django-ucamlookup versions up to 1.9.1

Description A vulnerability was found in the Lookup Handler component of django-ucamlookup, leading to cross-site scripting. The attack can be launched remotely. This issue affects products that are no longer supported by the maintainer.

Recommendations Upgrading to version 1.9.2 is able to address this issue. It is recommended to upgrade the affected component.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-15010

GHSA-PJX4-3F3P-29V3

PYSEC-2023-14

Affected Products

Django-Ucamlookup

References · 12

• https://github.com/uisautomation/django-ucamlookup/releases/tag/1.9.2 · Patch
• https://github.com/uisautomation/django-ucamlookup/commit/5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3 · Patch
• https://osv.dev/vulnerability/PYSEC-2023-14 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15010 · Security Note
• https://osv.dev/vulnerability/GHSA-pjx4-3f3p-29v3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-15010 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/django-ucamlookup/PYSEC-2023-14.yaml · Note
• https://github.com/uisautomation/django-ucamlookup · Note
• https://t.me/cibsecurity/55941 · Telegram Post
• https://vuldb.com/?id.217441 · Note
• https://vuldb.com/?ctiid.217441 · Note
• https://t.me/cvenotify/89341 · Telegram Post