CVE-2020-13596
published 2020-06-03CVE-2020-13596: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
2.87%
85.4th percentile
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | python-django | < python-django 2:2.2.13-1 (bookworm) | python-django 2:2.2.13-1 (bookworm) |
| djangoproject | django | >= 2.2 < 2.2.13 | 2.2.13 |
| djangoproject | django | >= 2.2a1 < 2.2.13 | 2.2.13 |
| djangoproject | django | >= 3.0 < 3.0.7 | 3.0.7 |
| djangoproject | django | >= 3.0a1 < 3.0.7 | 3.0.7 |
| fedoraproject | fedora | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XSS in Django
ghsa·2020-06-05
CVE-2020-13596 [MEDIUM] CWE-79 XSS in Django
XSS in Django
An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
OSV
XSS in Django
osv·2020-06-05
CVE-2020-13596 [MEDIUM] XSS in Django
XSS in Django
An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
OSV
python-django vulnerabilities
osv·2020-06-04·CVSS 5.9
CVE-2020-13254 [MEDIUM] python-django vulnerabilities
python-django vulnerabilities
USN-4381-1 fixed several vulnerabilities in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Dan Palmer discovered that Django incorrectly validated memcached cache
keys. A remote attacker could possibly use this issue to cause a denial of
service and obtain sensitive information. (CVE-2020-13254)
Jon Dufresne discovered that Django incorrectly encoded query parameters
for the admin ForeignKeyRawIdWidget. A remote attacker could possibly use
this issue to perform XSS attacks. (CVE-2020-13596)
OSV
python-django vulnerabilities
osv·2020-06-03·CVSS 5.9
CVE-2020-13254 [MEDIUM] python-django vulnerabilities
python-django vulnerabilities
Dan Palmer discovered that Django incorrectly validated memcached cache
keys. A remote attacker could possibly use this issue to cause a denial of
service and obtain sensitive information. (CVE-2020-13254)
Jon Dufresne discovered that Django incorrectly encoded query parameters
for the admin ForeignKeyRawIdWidget. A remote attacker could possibly use
this issue to perform XSS attacks. (CVE-2020-13596)
OSV
CVE-2020-13596: An issue was discovered in Django 2
osv·2020-06-03·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596: An issue was discovered in Django 2
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Ubuntu
Django vulnerabilities
vendor_ubuntu·2020-06-04·CVSS 5.9
CVE-2020-13254 [MEDIUM] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
USN-4381-1 fixed several vulnerabilities in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Dan Palmer discovered that Django incorrectly validated memcached cache
keys. A remote attacker could possibly use this issue to cause a denial of
service and obtain sensitive information. (CVE-2020-13254)
Jon Dufresne discovered that Django incorrectly encoded query parameters
for the admin ForeignKeyRawIdWidget. A remote attacker could possibly use
this issue to perform XSS attacks. (CVE-2020-13596)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
django: possible XSS via admin ForeignKeyRawIdWidget
vendor_redhat·2020-06-03·CVSS 6.1
CVE-2020-13596 [MEDIUM] CWE-79 django: possible XSS via admin ForeignKeyRawIdWidget
django: possible XSS via admin ForeignKeyRawIdWidget
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
A flaw was found in Django, where the query parameters for the admin widget `ForeignKeyRawIdWidget` were not properly URL encoded. This flaw allows an attacker to perform a Cross-site scripting (XSS) attack. The highest threat from this vulnerability is to confidentiality.
Statement: The following products ship the flawed code, however they do not make use of ForeignKeyRawIdWidget and are therefore not vulnerable to this flaw:
* Red Hat Satellite 6
* Red Hat Update Infrastructure 3
* Red Hat OpenStack Platform 13, 15, & 1
Ubuntu
Django vulnerabilities
vendor_ubuntu·2020-06-03·CVSS 5.9
CVE-2020-13254 [MEDIUM] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
Dan Palmer discovered that Django incorrectly validated memcached cache
keys. A remote attacker could possibly use this issue to cause a denial of
service and obtain sensitive information. (CVE-2020-13254)
Jon Dufresne discovered that Django incorrectly encoded query parameters
for the admin ForeignKeyRawIdWidget. A remote attacker could possibly use
this issue to perform XSS attacks. (CVE-2020-13596)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2020-13596: python-django - An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query ...
vendor_debian·2020·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596: python-django - An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query ...
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Scope: local
bookworm: resolved (fixed in 2:2.2.13-1)
bullseye: resolved (fixed in 2:2.2.13-1)
forky: resolved (fixed in 2:2.2.13-1)
sid: resolved (fixed in 2:2.2.13-1)
trixie: resolved (fixed in 2:2.2.13-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-13596 python2-django1.11: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
bugzilla·2020-06-09·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596 python2-django1.11: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
CVE-2020-13596 python2-django1.11: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mult
Bugzilla
CVE-2020-13596 python-django16: django: possible XSS via admin ForeignKeyRawIdWidget [epel-7]
bugzilla·2020-06-03·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596 python-django16: django: possible XSS via admin ForeignKeyRawIdWidget [epel-7]
CVE-2020-13596 python-django16: django: possible XSS via admin ForeignKeyRawIdWidget [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template
Bugzilla
CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
bugzilla·2020-06-03·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [epel-all]
bugzilla·2020-06-03·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [epel-all]
CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supp
Bugzilla
CVE-2020-13596 django: possible XSS via admin ForeignKeyRawIdWidget
bugzilla·2020-06-03·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596 django: possible XSS via admin ForeignKeyRawIdWidget
CVE-2020-13596 django: possible XSS via admin ForeignKeyRawIdWidget
Query parameters for the admin ``ForeignKeyRawIdWidget`` were not properly URL encoded, posing an XSS attack vector. ``ForeignKeyRawIdWidget`` now ensures query parameters are correctly URL encoded.
Reference:
https://www.djangoproject.com/weblog/2020/jun/03/security-releases/
Discussion:
Created django:1.6/python-django tracking bugs for this issue:
Affects: fedora-all [bug 1843630]
Created python-django tracking bugs for this issue:
Affects: epel-all [bug 1843626]
Affects: fedora-all [bug 1843627]
Affects: openstack-rdo [bug 1843631]
Created python-django16 tracking bugs for this issue:
Affects: epel-7 [bug 1843629]
---
External References:
https://www.djangoproject.com/weblog/2020/jun/03/security-releases
Bugzilla
CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [openstack-rdo]
bugzilla·2020-06-03·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [openstack-rdo]
CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Neither Horizon
Bugzilla
CVE-2020-13596 django:1.6/python-django: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
bugzilla·2020-06-03·CVSS 6.1
CVE-2020-13596 [MEDIUM] CVE-2020-13596 django:1.6/python-django: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
CVE-2020-13596 django:1.6/python-django: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affect
https://docs.djangoproject.com/en/3.0/releases/security/https://groups.google.com/forum/#%21msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/https://security.netapp.com/advisory/ntap-20200611-0002/https://usn.ubuntu.com/4381-1/https://usn.ubuntu.com/4381-2/https://www.debian.org/security/2020/dsa-4705https://www.djangoproject.com/weblog/2020/jun/03/security-releases/https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://docs.djangoproject.com/en/3.0/releases/security/https://groups.google.com/forum/#%21msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/https://security.netapp.com/advisory/ntap-20200611-0002/https://usn.ubuntu.com/4381-1/https://usn.ubuntu.com/4381-2/https://www.debian.org/security/2020/dsa-4705https://www.djangoproject.com/weblog/2020/jun/03/security-releases/https://www.oracle.com/security-alerts/cpujan2021.html
2020-06-03
Published