CVE-2008-2302 Django Cross-site scripting (XSS) vulnerability
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 0.91, < 0.91.2 | 0.91.2 |
| pypi django(PyPI) | >= 0.95, < 0.95.3 | 0.95.3 |
| pypi django(PyPI) | >= 0.96, < 0.96.2 | 0.96.2 |
| pypi django(PyPI) | < 1.1 | 1.1 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| django project django | = 0.91 | No fix listed |
| django project django | = 0.95 | No fix listed |
| django project django | = 0.96 | No fix listed |
| debian/python-django(Debian:12) | < 0.96.2-1 | 0.96.2-1 |
| debian/python-django(Debian:13) | < 0.96.2-1 | 0.96.2-1 |
| debian/python-django(Debian:14) | < 0.96.2-1 | 0.96.2-1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- django-loginform-xss(42396) vdb-entry
- github.com product
- github.com
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- www.djangoproject.com patch technical-description
- 29209 patch vdb-entry
- 1020028 vdb-entry
- 30250 patch third-party-advisory vendor-advisory
- 30291 third-party-advisory vendor-advisory
- ADV-2008-1618 vdb-entry vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2008-2302 vendor-advisory
- bugs.debian.org issue-tracking