CVE-2020-13596 — Cross-site Scripting in Django
Severity
6.1MEDIUMNVD
OSV5.9
EPSS
1.0%
top 23.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 3
Latest updateJun 9
Description
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages3 packages
Also affects: Debian Linux 10.0, 9.0, Fedora 32, Ubuntu Linux 14.04, 16.04, 18.04, 19.10, 20.04
Patches
🔴Vulnerability Details
6📋Vendor Advisories
4💬Community
7Bugzilla▶
CVE-2020-13596 python2-django1.11: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]↗2020-06-09
Bugzilla▶
CVE-2020-13596 python-django16: django: possible XSS via admin ForeignKeyRawIdWidget [epel-7]↗2020-06-03
Bugzilla▶
CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [fedora-all]↗2020-06-03
Bugzilla▶
CVE-2020-13596 python-django: django: possible XSS via admin ForeignKeyRawIdWidget [epel-all]↗2020-06-03