VulnerabilityModified
CVE-2020-13596
Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
MEDIUM 6.1EPSS 2.90%
Does this matter?
Lower severity and a low EPSS score (2.90%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 2.90% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- djangoproject/django · fedoraproject/fedora · canonical/ubuntu linux · netapp/sra plugin · netapp/steelstore cloud integrated storage · debian/debian linux · oracle/zfs storage appliance kit
- Source
- cve@mitre.org
References
- https://docs.djangoproject.com/en/3.0/releases/security/Release Notes, Vendor Advisory
- https://groups.google.com/forum/#%21msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
- https://security.netapp.com/advisory/ntap-20200611-0002/Third Party Advisory
- https://usn.ubuntu.com/4381-1/Third Party Advisory
- https://usn.ubuntu.com/4381-2/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4705Third Party Advisory
- https://www.djangoproject.com/weblog/2020/jun/03/security-releases/Release Notes, Vendor Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
- https://docs.djangoproject.com/en/3.0/releases/security/Release Notes, Vendor Advisory
- https://groups.google.com/forum/#%21msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
- https://security.netapp.com/advisory/ntap-20200611-0002/Third Party Advisory
- https://usn.ubuntu.com/4381-1/Third Party Advisory
- https://usn.ubuntu.com/4381-2/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4705Third Party Advisory
- https://www.djangoproject.com/weblog/2020/jun/03/security-releases/Release Notes, Vendor Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.