CVE-2022-22818: XSS
A flaw was found in Django. The {% debug %} template tag did not properly encode the current context, posing a Cross-site scripting attack vector (XSS).
Other sources
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
— GitHub
The {% debug %} template tag didn't properly encode the current context, posing an XSS attack vector. In order to avoid this vulnerability, {% debug %} no longer outputs an information when the DEBUG setting is False, and it ensures all context variables are correctly escaped when the DEBUG setting is True.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-22818.
What is the severity level of CVE-2022-22818?
The severity level of CVE-2022-22818 is medium with a CVSS score of 6.1.
What is the affected software?
The affected software includes Django versions 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.
How does the vulnerability impact the affected software?
The vulnerability in Django may lead to XSS (Cross-Site Scripting) attacks.
How do I fix CVE-2022-22818?
You can fix CVE-2022-22818 by upgrading Django to versions 2.2.27, 3.2.12, or 4.0.2 depending on your current version.