PT-2024-40898 · Unknown · Django Cms

Published 2024-11-18 · Updated 2024-11-18

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions django-cms versions 3.11.7 through 3.11.8 django-cms versions 4.1.2 through 4.1.3

Description The issue affects django-cms, allowing Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation.

Recommendations For django-cms versions 3.11.7 and 3.11.8, update to a version that fixes the improper neutralization of input during web page generation. For django-cms versions 4.1.2 and 4.1.3, update to a version that fixes the improper neutralization of input during web page generation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

PYSEC-2024-124

Affected Products

Django Cms

References · 5

• https://osv.dev/vulnerability/PYSEC-2024-124 · Vendor Advisory
• https://github.com/django-cms/django-cms/commit/241d1cbe47a68f5d271ce4d27ad5e32e2c360ec3 · Note
• https://iltosec.com/blog/post/django-cms-413-stored-xss-vulnerability-exploiting-the-page-title-field · Note
• https://usom.gov.tr/bildirim/tr-24-1859 · Note
• https://django-cms.org/en/blog/2024/11/13/django-cms-security-update · Note