VDB
BIT-django-2020-13596
BIT-django-2020-13596
PUBLISHED
CVSS 6.099999904632568 MEDIUM
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | django | 2.2.0, 3.0.0, 2.2.0 |
Timeline
- Mar 6, 2024 CVE Published
- Apr 3, 2025 CVE Updated
- May 15, 2026 Distribution Patch
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-13596 url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/ url
- https://www.djangoproject.com/weblog/2020/jun/03/security-releases/ url
- https://docs.djangoproject.com/en/3.0/releases/security/ url
- https://security.netapp.com/advisory/ntap-20200611-0002/ url
- https://groups.google.com/forum/#%21msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ url
- https://usn.ubuntu.com/4381-2/ url
- https://www.debian.org/security/2020/dsa-4705 url
- https://usn.ubuntu.com/4381-1/ url
- https://www.oracle.com/security-alerts/cpujan2021.html url