Описание
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious
Отчет
In Red Hat Ceph Storage 2, python-djangorestframework is embedded in calamari-server. However, calamari-server is no longer supported and will not be fixed.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 2 | calamari-server | Out of support scope | ||
| Red Hat Ansible Tower 3.6 for RHEL 7 | ansible-tower-36/ansible-tower | Fixed | RHSA-2020:4137 | 30.09.2020 |
| Red Hat Ansible Tower 3.7 for RHEL 7 | ansible-tower-37/ansible-tower-rhel7 | Fixed | RHSA-2020:4136 | 30.09.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
A flaw was found in Django REST Framework versions before 3.12.0 and b ...
Cross-site Scripting (XSS) in Django REST Framework
EPSS
5.4 Medium
CVSS3