CVE-2020-25626 Common Vulnerabilities and Exposures

Upstream information

CVE-2020-25626 at MITRE

Description

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	None

CVSS v3 Scores
	National Vulnerability Database	SUSE
Base Score	6.1	7.1
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Attack Vector	Network	Network
Attack Complexity	Low	High
Privileges Required	None	Low
User Interaction	Required	Required
Scope	Changed	Changed
Confidentiality Impact	Low	Low
Integrity Impact	Low	High
Availability Impact	None	Low
CVSSv3 Version	3.1	3.1

SUSE Bugzilla entry: 1177205 [RESOLVED / FIXED]

SUSE Security Advisories:

openSUSE-SU-2021:0322-1, published Mon Feb 22 03:37:57 2021
openSUSE-SU-2021:0338-1, published Thu Feb 25 15:38:33 2021

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 15 SP2	`python3-djangorestframework >= 3.11.2-bp152.2.3.1`	Patchnames: openSUSE-2021-338
SUSE Package Hub 15 SP6	`python3-djangorestframework >= 3.11.2-bp156.5.1` `python3-djangorestframework-simplejwt >= 4.6.0-bp156.4.1` `python3-pytest-django >= 3.9.0-bp156.4.1`	Patchnames: openSUSE-2024-365
openSUSE Leap 15.2	`python3-djangorestframework >= 3.11.2-lp152.2.3.1`	Patchnames: openSUSE-2021-322
openSUSE Leap 15.6	`python3-djangorestframework >= 3.11.2-bp156.5.1` `python3-djangorestframework-simplejwt >= 4.6.0-bp156.4.1` `python3-pytest-django >= 3.9.0-bp156.4.1`	Patchnames: openSUSE-2024-365
openSUSE Tumbleweed	`python310-djangorestframework >= 3.15.1-1.1` `python311-djangorestframework >= 3.15.1-1.1` `python312-djangorestframework >= 3.15.1-1.1` `python36-djangorestframework >= 3.12.4-1.2` `python38-djangorestframework >= 3.12.4-1.2` `python39-djangorestframework >= 3.12.4-1.2`	Patchnames: openSUSE-Tumbleweed-2024-11227 openSUSE-Tumbleweed-2024-13861

SUSE Timeline for this CVE

CVE page created: Wed Sep 30 13:18:15 2020
CVE page last modified: Sun Nov 10 12:39:24 2024