onyx --cves cve-2019-12308
CVE-2019-12308
- score
- <0.1
- cvss
- 6.1
- epss
- 2.4%
- published
- 2019-06-03
- kev added
- —
- first seen
Django 1.11 < 1.11.21, 2.1 < 2.1.9, and 2.2 < 2.2.2 contain a cross-site scripting caused by unvalidated URL values displayed in AdminURLFieldWidget, letting attackers inject malicious JavaScript, exploit requires attacker to control URL input or database value.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 17
- https://docs.djangoproject.com/en/dev/releases/2.1.9/
- https://docs.djangoproject.com/en/dev/releases/security/
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html
- https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html
- https://docs.djangoproject.com/en/dev/releases/2.2.2/
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
- http://www.securityfocus.com/bid/108559
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/
- https://seclists.org/bugtraq/2019/Jul/10
- https://security.gentoo.org/glsa/202004-17
- https://usn.ubuntu.com/4043-1/
- https://www.debian.org/security/2019/dsa-4476
- https://www.djangoproject.com/weblog/2019/jun/03/security-releases/
- http://www.openwall.com/lists/oss-security/2019/06/03/2
- https://groups.google.com/forum/#%21topic/django-announce/GEbHU7YoVz8
- https://docs.djangoproject.com/en/dev/releases/1.11.21/