Django Filer Unrestricted Upload of File with Dangerous Type
Date: 2024-11
Affected: pip/django-filer
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-11404
CWE: CWE-20
CWE-434
CWE-80
CVSS: 5.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.


Mitigations:

Architectural layers (MAESTRO):