Home > Vulnerability Database > CVE-2019-12308

Mend.io Vulnerability Database

CVE-2019-12308

Good to know:

Date: June 3, 2019

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

Language: Python

Severity Score

6.1

Related Resources (34)

Url: https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G

Url: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html

Url: https://docs.djangoproject.com/en/dev/releases/security

Url: https://github.com/django/django

Url: https://www.djangoproject.com/weblog/2019/jun/03/security-releases/

Url: https://docs.djangoproject.com/en/dev/releases/1.11.21

Url: http://www.openwall.com/lists/oss-security/2019/06/03/2

Url: https://docs.djangoproject.com/en/dev/releases/2.2.2/

Url: https://usn.ubuntu.com/4043-1

Url: https://www.djangoproject.com/weblog/2019/jun/03/security-releases

Url: https://usn.ubuntu.com/4043-1/

Url: https://docs.djangoproject.com/en/dev/releases/2.1.9/

Url: https://nvd.nist.gov/vuln/detail/CVE-2019-12308

Url: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html

Url: https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62

Url: https://github.com/advisories/GHSA-7rp2-fm2h-wchj

Url: http://www.securityfocus.com/bid/108559

Url: https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b

Url: https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html

Url: https://docs.djangoproject.com/en/dev/releases/security/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/

Url: https://seclists.org/bugtraq/2019/Jul/10

Url: https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yaml

Url: https://www.debian.org/security/2019/dsa-4476

Url: https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8

Url: https://docs.djangoproject.com/en/dev/releases/2.1.9

Url: https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/

Url: https://security.gentoo.org/glsa/202004-17

Url: https://docs.djangoproject.com/en/dev/releases/2.2.2

Url: https://groups.google.com/forum/#%21topic/django-announce/GEbHU7YoVz8

Url: https://docs.djangoproject.com/en/dev/releases/1.11.21/

Url: https://www.mend.io/vulnerability-database/CVE-2019-12308

Severity Score

6.1

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

Top Fix

Upgrade Version

Upgrade to version 1.11.21,2.1.9,2.2.2

Learn More

CVSS v3.1

Base Score:	6.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2019-12308

Good to know:

Date: June 3, 2019

Language: Python

Severity Score

Related Resources (34)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?