CVE-2020-25626

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious tags, leading to a cross-site-scripting (XSS) vulnerability.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2020-25626 djangorestframework Corrigé dans: 3.12.1-1
Ubuntu UBUNTU-CVE-2020-25626 djangorestframework

Références

advisory security.netapp.com
advisory debian.org
report bugzilla.redhat.com