CVE-2019-12308: XSS
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12308?
The severity of CVE-2019-12308 is medium with a severity value of 6.1.
Which versions of Django are affected by CVE-2019-12308?
Django versions 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2 are affected by CVE-2019-12308.
What is the remedy for CVE-2019-12308?
To fix CVE-2019-12308, upgrade Django to version 2.2.2, 2.1.9, or 1.11.21 depending on the version currently installed.
Where can I find more information about CVE-2019-12308?
You can find more information about CVE-2019-12308 on the NIST National Vulnerability Database (NVD), the Openwall OSS Security mailing list, and the Django official documentation.
What is the CWE classification for CVE-2019-12308?
CVE-2019-12308 is classified under CWE-79, which is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').