CVE-2020-13596 XSS in Django
MediumCVSS 6.1
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 2.2a1, < 2.2.13 | 2.2.13 |
| pypi django(PyPI) | = 2.2 | No fix listed |
| pypi django(PyPI) | = 2.2.1 | No fix listed |
| pypi django(PyPI) | = 2.2.10 | No fix listed |
| pypi django(PyPI) | = 2.2.11 | No fix listed |
| pypi django(PyPI) | = 2.2.12 | No fix listed |
| pypi django(PyPI) | = 2.2.2 | No fix listed |
| pypi django(PyPI) | = 2.2.3 | No fix listed |
| pypi django(PyPI) | = 2.2.4 | No fix listed |
| pypi django(PyPI) | = 2.2.5 | No fix listed |
| pypi django(PyPI) | = 2.2.6 | No fix listed |
| pypi django(PyPI) | = 2.2.7 | No fix listed |
| pypi django(PyPI) | = 2.2.8 | No fix listed |
| pypi django(PyPI) | = 2.2.9 | No fix listed |
| pypi django(PyPI) | = 2.2a1 | No fix listed |
| pypi django(PyPI) | = 2.2b1 | No fix listed |
| pypi django(PyPI) | = 2.2rc1 | No fix listed |
| pypi django(PyPI) | >= 3.0a1, < 3.0.7 | 3.0.7 |
| pypi django(PyPI) | = 3.0 | No fix listed |
| pypi django(PyPI) | = 3.0.1 | No fix listed |
| pypi django(PyPI) | = 3.0.2 | No fix listed |
| pypi django(PyPI) | = 3.0.3 | No fix listed |
| pypi django(PyPI) | = 3.0.4 | No fix listed |
| pypi django(PyPI) | = 3.0.5 | No fix listed |
| pypi django(PyPI) | = 3.0.6 | No fix listed |
Show 33 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 3.0a1 | No fix listed |
| pypi django(PyPI) | = 3.0b1 | No fix listed |
| pypi django(PyPI) | = 3.0rc1 | No fix listed |
| pypi django(PyPI) | >= 2.2, < 2.2.13 | 2.2.13 |
| pypi django(PyPI) | >= 3.0, < 3.0.7 | 3.0.7 |
| debian/python-django(Debian:12) | < 2:2.2.13-1 | 2:2.2.13-1 |
| debian/python-django(Debian:13) | < 2:2.2.13-1 | 2:2.2.13-1 |
| debian/python-django(Debian:14) | < 2:2.2.13-1 | 2:2.2.13-1 |
| djangoproject django | >= 2.2, < 2.2.13 | 2.2.13 |
| djangoproject django | >= 3.0, < 3.0.7 | 3.0.7 |
| fedoraproject fedora | = 32 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 19.10 | No fix listed |
| Canonical Ubuntu Linux | = 20.04 | No fix listed |
| netapp sra plugin | All versions | No fix listed |
| netapp steelstore cloud integrated storage | All versions | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| oracle zfs storage appliance kit | = 8.8 | No fix listed |
| alpine/py3-django(Alpine:v3.13) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.14) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.15) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.16) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.17) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.18) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.19) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.20) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.21) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.22) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.23) | < 3.0.7-r0 | 3.0.7-r0 |
| alpine/py3-django(Alpine:v3.24) | < 3.0.7-r0 | 3.0.7-r0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- docs.djangoproject.com release-notes vendor-advisory
- github.com vendor-advisory
- github.com product
- github.com
- groups.google.com
- lists.fedoraproject.org
- security.netapp.com third-party-advisory vendor-advisory
- USN-4381-1 third-party-advisory vendor-advisory
- USN-4381-2 third-party-advisory vendor-advisory
- DSA-4705 third-party-advisory vendor-advisory
- www.djangoproject.com release-notes technical-description vendor-advisory
- www.oracle.com patch third-party-advisory
- Debian Security Tracker CVE-2020-13596 vendor-advisory
- FEDORA-2020-c2639662af vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking