Cross-Site Scripting Flaw in Django CMS by Django Software Foundation
CVE-2021-44649

5.4MEDIUM

Key Information:

Vendor

Django-cms

Status
Django Cms
Vendor
CVE Published:
12 January 2022

What is CVE-2021-44649?

Django CMS 3.7.3 features a vulnerability that lacks proper validation of the plugin_type parameter when generating error messages. This oversight allows attackers to exploit the system by injecting arbitrary JavaScript into the web browser of affected users, potentially compromising user data and session integrity. Proper error handling and validation are crucial to prevent such exploits in web applications.

References

https://sahildhar.github.io/blogpost/Django-CMS-Reflected...
x_refsource_MISC
https://www.django-cms.org/en/blog/2020/07/22/django-cms-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.