onyx --cves cve-2022-22818
CVE-2022-22818
- score
- <0.1
- cvss
- 6.1
- epss
- 3.4%
- published
- 2022-02-03
- kev added
- —
- first seen
Django 2.2 < 2.2.27, 3.2 < 3.2.12, and 4.0 < 4.0.2 contain a cross-site scripting caused by improper encoding in the {% debug %} template tag, letting attackers inject malicious scripts, exploit requires attacker to control template context.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 6
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://security.netapp.com/advisory/ntap-20220221-0003/
- https://www.debian.org/security/2022/dsa-5254
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/