CVE-2019-3498: Input Validation
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Other sources
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-3498?
CVE-2019-3498 is a vulnerability in Django versions 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5 that allows for content spoofing in a 404 error page.
How severe is CVE-2019-3498?
CVE-2019-3498 has a severity rating of 6.5 (medium).
Which versions of Django are affected by CVE-2019-3498?
Django versions 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5 are affected.
How can I fix CVE-2019-3498?
To fix CVE-2019-3498, update Django to version 2.1.5 (for 2.1.x), 2.0.10 (for 2.0.x), or 1.11.18 (for 1.11.x).
Where can I find more information about CVE-2019-3498?
You can find more information about CVE-2019-3498 at the following sources: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-3498), [Django releases](https://docs.djangoproject.com/en/dev/releases/security/), and [GitHub advisory](https://github.com/advisories/GHSA-337x-4q8g-prc5).