CVE-2020-13596
Medium
Description
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Django
PublishedJun 3, 2020
First seenJun 3, 2020
How to fix
Update
- djangoproject django2.2.13, 3.0.7 or later
- django2.2.13, 3.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| djangoproject django | 2.2 ≤ v < 2.2.13, 3.0 ≤ v < 3.0.7 | 2.2.13, 3.0.7 |
| fedoraproject fedora | 32 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 19.10, 20.04 | — |
| netapp sra_plugin | No range specified | — |
| netapp steelstore_cloud_integrated_storage | No range specified | — |
| debian debian_linux | 9.0, 10.0 | — |
| oracle zfs_storage_appliance_kit | 8.8 | — |
| djangoPyPI | 2.2a1 ≤ v < 2.2.13, 3.0a1 ≤ v < 3.0.7, 2.2 ≤ v < 2.2.13, 3.0 ≤ v < 3.0.7 | 2.2.13, 3.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.