6.1med
CVE-2008-2302
Django Cross-site scripting (XSS) vulnerability
Also known as GHSA-54qj-48vx-cr9f, PYSEC-2008-1
Published 18 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.1 · GitHub
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
0
none known
Summary
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
Exploit prediction (EPSS)
1.31% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | django | >=0.91, <0.91.2 >=0.95, <0.95.3 >=0.96, <0.96.2 <1.1 | 0.91.2 0.95.3 0.96.2 1.1 |
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
- Django (RSS, critical only)
References
- secunia.com /advisories/30250 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- securitytracker.com /id?1020028 · vdb-entry, x_refsource_SECTRACK, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/42396 · vdb-entry, x_refsource_XF, x_transferred
- secunia.com /advisories/30291 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- securityfocus.com /bid/29209 · vdb-entry, x_refsource_BID, x_transferred
- vupen.com /english/advisories/2008/1618 · vdb-entry, x_refsource_VUPEN, x_transferred
- djangoproject.com /weblog/2008/may/14/security/ · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2008-2302 · advisory
- github.com /django/django/commit/50ce7fb57d79e8940ccf6e2781f2f01df029b5c5 · web
- github.com /django/django/commit/6e657e2c404a96e744748209e896d8a69c15fdf2 · web
- github.com /django/django/commit/7791e5c050cebf86d868c5dab7092185b125fdc9 · web
- github.com /django/django · package
- github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-1.yaml · web
- web.archive.org /web/20080725022008/http://secunia.com/advisories/30291 · web
- web.archive.org /web/20081012011038/http://secunia.com/advisories/30250 · web
- web.archive.org /web/20170222015451/http://securitytracker.com/id?1020028 · web
- web.archive.org /web/20200228153339/http://www.securityfocus.com/bid/29209 · web
- djangoproject.com /weblog/2008/may/14/security · web
- github.com /advisories/GHSA-54qj-48vx-cr9f · advisory
Sources
- CVE List: CVE-2008-2302
- GitHub Advisory: GHSA-54qj-48vx-cr9f
- NVD: CVE-2008-2302
- OSV: PYSEC-2008-1
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.