PT-2024-19268 · Unknown · Django Template Engine

Bastianwegge

·

Published

2024-01-11

·

Updated

2024-01-18

·

CVE-2024-22199

CVSS v3.1

9.3

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Name of the Vulnerable Software and Affected Versions Django template engine for Fiber versions prior to the latest patched version
Description This issue specifically impacts web applications that render user-supplied data through the Django template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability allows for Cross-Site Scripting (XSS) attacks. The template engine now defaults to having autoescape set to true, effectively mitigating the risk of XSS attacks.
Recommendations For versions prior to the latest patched version, upgrade to the latest version of the Django template engine for Fiber, where this security update is implemented. As a temporary workaround for users unable to upgrade immediately, manually implement autoescaping within individual Django templates by adding specific tags to control autoescape behavior, such as {% autoescape on %} and {% endautoescape %}.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

RCE

Weakness Enumeration

Related Identifiers

CVE-2024-22199
GHSA-4MQ2-GC4J-CMW6
GO-2024-2461

Affected Products

Django Template Engine