Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications Section
CVE-2021-25986

5.4MEDIUM

Key Information:

Vendor

Django-wiki

Status
Django-wiki
Vendor
CVE Published:
23 November 2021

What is CVE-2021-25986?

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.

Affected Version(s)

Django-wiki 0.0.20

Django-wiki <= 0.7.8

References

https://github.com/django-wiki/django-wiki/commit/9eaccc7...
x_refsource_MISC
https://www.whitesourcesoftware.com/vulnerability-databas...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

WhiteSource Vulnerability Research Team (WVR)
.