GHSA-hx7c-qpfq-xcrp
Cross-site Scripting in django-cms
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | django-cms | >= 3.7.0, < 3.7.4 | 3.7.4 |
| PyPI | django-cms | >= 3.6.0, < 3.6.1 | 3.6.1 |
| PyPI | django-cms | >= 3.5.0, < 3.5.4 | 3.5.4 |
| PyPI | django-cms | >= 3.4.0, < 3.4.7 | 3.4.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2021-44649
- https://github.com/advisories/GHSA-hx7c-qpfq-xcrp
- https://github.com/divio/django-cms
- https://github.com/pypa/advisory-database/tree/main/vulns/django-cms/PYSEC-2022-7.yaml
- https://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability
- https://www.django-cms.org/en/blog/2020/07/22/django-cms-security-updates-1