Django Cross-site scripting (XSS) vulnerability
Date: 2022-05
Affected: pip/django, pip/django, pip/django
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2008-2302
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.


Mitigations:

Architectural layers (MAESTRO):