CVE-2008-2302

Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.djangoproject.com/weblog/2008/may/14/security/	Patch
http://www.securityfocus.com/bid/29209	Patch
http://securitytracker.com/id?1020028
http://secunia.com/advisories/30250	Patch Vendor Advisory
http://secunia.com/advisories/30291
http://www.vupen.com/english/advisories/2008/1618
https://exchange.xforce.ibmcloud.com/vulnerabilities/42396

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:django_project:django:0.91:::::::*
	cpe:2.3:a:django_project:django:0.95:::::::*
	cpe:2.3:a:django_project:django:0.96:::::::*

Information

Published : 2008-05-23 08:32

Updated : 2017-08-07 18:30

NVD link : CVE-2008-2302

Mitre link : CVE-2008-2302

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

django_project

django

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.djangoproject.com/weblog/2008/may/14/security/", "name": "http://www.djangoproject.com/weblog/2008/may/14/security/", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/29209", "name": "29209", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1020028", "name": "1020028", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/30250", "name": "30250", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/30291", "name": "30291", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2008/1618", "name": "ADV-2008-1618", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42396", "name": "django-loginform-xss(42396)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-2302", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2008-05-23T15:32Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:django_project:django:0.91:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:django_project:django:0.95:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:django_project:django:0.96:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-08T01:30Z"}