CVE-2008-2302

MEDIUM6.1EPSS 0.44%

Django Cross-site scripting (XSS) vulnerability

Published: 5/1/2022Modified: 4/28/2026

Description

Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

Affected packages (3)

Debian/python-djangofrom 0, < 0.96.2-1
PyPI/django>= 0.91, < 0.91.2
PyPI/djangofrom 0, < 1.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (19)

ADVISORYhttp://secunia.com/advisories/30250
ADVISORYhttp://secunia.com/advisories/30291
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2008-2302
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2008-2302
ADVISORYhttp://www.djangoproject.com/weblog/2008/may/14/security/
ADVISORYhttp://www.vupen.com/english/advisories/2008/1618
PATCHhttps://github.com/django/django
WEBhttp://securitytracker.com/id?1020028
WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/42396
WEBhttps://github.com/django/django/commit/50ce7fb57d79e8940ccf6e2781f2f01df029b5c5
WEBhttps://github.com/django/django/commit/6e657e2c404a96e744748209e896d8a69c15fdf2
WEBhttps://github.com/django/django/commit/7791e5c050cebf86d868c5dab7092185b125fdc9
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-1.yaml
WEBhttps://web.archive.org/web/20080725022008/http://secunia.com/advisories/30291
WEBhttps://web.archive.org/web/20081012011038/http://secunia.com/advisories/30250
WEBhttps://web.archive.org/web/20170222015451/http://securitytracker.com/id?1020028
WEBhttps://web.archive.org/web/20200228153339/http://www.securityfocus.com/bid/29209
WEBhttp://www.djangoproject.com/weblog/2008/may/14/security
WEBhttp://www.securityfocus.com/bid/29209