Vulnerability advisory
CVE-2022-22818
Also known as BIT-django-2022-22818GHSA-95rw-fx8r-36v6PYSEC-2022-19
Severity
Severity not reported.
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/django/django ↗ | |
| 2a62cdcfec85938f40abb2e9e6a9ff497e02afe8 to before e541f2d05b88e58c18b82b622aacc38d670eb5f6 | e541f2d05b88e58c18b82b622aacc38d670eb5f6 |
| 3591e1c1acbd7c13174275367c3fdf012cb0413b to before fdf209eab8949ddc345aa0212b349c79fc6fdebb | fdf209eab8949ddc345aa0212b349c79fc6fdebb |
| ef62a3a68c9d558486145a42c0d71ea9a76add9e to before b12be7ad6b83ffc512252953ef28d0d099f96ad7 | b12be7ad6b83ffc512252953ef28d0d099f96ad7 |
Description
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
References
- Webdocs.djangoproject.com/en/4.0/releases/security/ ↗
- Webgroups.google.com/forum/#%21forum/django-announce ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22818.json ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-22818 ↗
- Advisorysecurity.netapp.com/advisory/ntap-20220221-0003/ ↗
- Advisorywww.debian.org/security/2022/dsa-5254 ↗
- ARTICLEwww.djangoproject.com/weblog/2022/feb/01/security-releases/ ↗