Skip to content
OpenAdvisories
Medium WID-SEC-2024-3516 2 CVEs

Django: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Nov 20, 2024 · Updated Nov 20, 2024 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.

Vulnerabilities 2

  • Medium 6.9
    CVE-2024-11406

    Stored XSS in django CMS Attributes Fields

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS. This issue affects django CMS Attributes Fields: before 4.0.

    django CMS Association django CMS Attributes Fields djangocms-attributes-field PyPI
  • Medium 5.5
    CVE-2024-11404

    File Upload Bypass in django Filer

    Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS. This issue affects django Filer: fr…

    django CMS Association django Filer django-filer PyPI

Revision history

  1. #1

    Initiale Fassung

References