DescriptionA flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
|National Vulnerability Database|
|National Vulnerability Database||SUSE|
SUSE Security Advisories:
- openSUSE-SU-2021:0322-1, published Mon Feb 22 03:37:57 2021
- openSUSE-SU-2021:0338-1, published Thu Feb 25 15:38:33 2021
List of released packages
|Product(s)||Fixed package version(s)||References|
|SUSE Package Hub 15 SP2|| ||Patchnames: |
|openSUSE Leap 15.2|| ||Patchnames: |
|openSUSE Tumbleweed|| ||Patchnames: |
openSUSE Tumbleweed GA python36-djangorestframework-3.12.4-1.2
SUSE Timeline for this CVECVE page created: Wed Sep 30 13:18:15 2020
CVE page last modified: Wed Oct 26 22:43:18 2022