FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

django -- XSS vulnerability

Affected packages
py23-django < 0.96.2
py24-django < 0.96.2
py25-django < 0.96.2
py23-django-devel < 20080511
py24-django-devel < 20080511
py25-django-devel < 20080511

Details

VuXML ID f49ba347-2190-11dd-907c-001c2514716c
Discovery 2008-05-10
Entry 2008-05-14
Modified 2010-05-12

Django project reports:

The Django administration application will, when accessed by a user who is not sufficiently authenticated, display a login form and ask the user to provide the necessary credentials before displaying the requested page. This form will be submitted to the URL the user attempted to access, by supplying the current request path as the value of the form's "action" attribute.

The value of the request path was not being escaped, creating an opportunity for a cross-site scripting (XSS) attack by leading a user to a URL which contained URL-encoded HTML and/or JavaScript in the request path.

References

CVE Name CVE-2008-2302
URL http://www.djangoproject.com/weblog/2008/may/14/security/