Medium · 6.1 CVE-2020-19002 EUVD-2021-0134GHSA-fpv7-hx6r-9vcxPYSEC-2021-343

Mezzanine Cross Site Scripting (XSS) vulnerability

Published Aug 27, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	mezzanine	<= 6.0.0	—	GHSA-fpv7-hx6r-9vcx
PyPI	mezzanine	all versions	—	PYSEC-2021-343

References

https://github.com/stephenmcd/mezzanine/issues/1921