CVE-2008-2302 | Vulnetix

CVE-2008-2302 PUBLISHED CVSS 6.099999904632568 MEDIUM

Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

EPSS 1.32% · 70.6th percentile

Risk Scores

CVSS 3.1

6.099999904632568

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

1.32%

70.6th percentile

Affected Products

Vendor	Product	Versions
PyPI	Django	0.96, 0.91, 0.95
django_project	django	0.91, 0.95, 0.96
n/a	n/a	n/a

Timeline

May 23, 2008 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 22, 2022 EPSS Score
Jul 15, 2022 EPSS Score
Oct 30, 2022 EPSS Score
Dec 22, 2022 EPSS Score
Feb 14, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 8, 2023 EPSS Score
Jun 1, 2023 EPSS Score
Jul 24, 2023 EPSS Score

References

30291 third-party-advisory
29209 vdb
30250 third-party-advisory
1020028 vdb
django-loginform-xss(42396) vdb
ADV-2008-1618 vdb
http://www.djangoproject.com/weblog/2008/may/14/security/ url
https://nvd.nist.gov/vuln/detail/CVE-2008-2302 advisory
https://github.com/django/django/commit/50ce7fb57d79e8940ccf6e2781f2f01df029b5c5 url
https://github.com/django/django/commit/6e657e2c404a96e744748209e896d8a69c15fdf2 url
https://github.com/django/django/commit/7791e5c050cebf86d868c5dab7092185b125fdc9 url
https://github.com/django/django package
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-1.yaml url
https://web.archive.org/web/20080725022008/http://secunia.com/advisories/30291 url
https://web.archive.org/web/20081012011038/http://secunia.com/advisories/30250 url
https://web.archive.org/web/20170222015451/http://securitytracker.com/id?1020028 url
https://web.archive.org/web/20200228153339/http://www.securityfocus.com/bid/29209 url
http://www.djangoproject.com/weblog/2008/may/14/security url

Open in Interactive Console →