medium6.1
CVE-2018-25045
Django REST framework XSS Vulnerability
Impact
Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | django-rest-framework | < 3.9.1 | 3.9.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Django-Rest-Framework | Django Rest Framework | before 3.9.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8
- https://github.com/encode/django-rest-framework/pull/6191
- https://github.com/encode/django-rest-framework/pull/6330
- https://github.com/advisories/GHSA-xqcf-hj92-967m
- https://nvd.nist.gov/vuln/detail/CVE-2018-25045