Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Django Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2019-12308 - Vulnerability Database
Django

Django Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2019-12308

Medium
Reference: CVE-2019-12308
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-12308
Title: Django Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

An issue was discovered in Django 1.11 before 1.11.21 2.1 before 2.1.9 and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus an unvalidated value stored in the database or a value provided as a URL query parameter payload could result in an clickable JavaScript link.