PyPI: django
CVE-2020-13596
Safety vulnerability ID: SFTY-20200603-76612
Safety legacy ID: pyup.io-38372
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Overview
XSS in Django
Advisory
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20200603-76612/CVE-2020-13596
- https://nvd.nist.gov/vuln/detail/CVE-2020-13596
- https://groups.google.com/forum/#!msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ
- https://www.debian.org/security/2020/dsa-4705
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://github.com/django/django/commit/1f2dd37f6fcefdd10ed44cb233b2e62b520afb38
- https://github.com/django/django/commit/6d61860b22875f358fac83d903dc629897934815
- https://docs.djangoproject.com/en/3.0/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ
- https://security.netapp.com/advisory/ntap-20200611-0002
- https://usn.ubuntu.com/4381-1
- https://usn.ubuntu.com/4381-2
- https://www.djangoproject.com/weblog/2020/jun/03/security-releases
- https://github.com/advisories/GHSA-2m34-jcjv-45xf
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-32.yaml
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more