VDB
CVE-2008-2302
CVE-2008-2302
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
EPSS 0.44% · 63.6th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
0.44%
63.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | Django | 0.96, 0.91, 0.95 |
| django_project | django | 0.91, 0.95, 0.96 |
| n/a | n/a | n/a |
Timeline
- May 23, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
References
- 30250 third-party-advisory
- 1020028 vdb
- django-loginform-xss(42396) vdb
- 30291 third-party-advisory
- 29209 vdb
- ADV-2008-1618 vdb
- http://www.djangoproject.com/weblog/2008/may/14/security/ url
- https://nvd.nist.gov/vuln/detail/CVE-2008-2302 advisory
- https://github.com/django/django/commit/50ce7fb57d79e8940ccf6e2781f2f01df029b5c5 url
- https://github.com/django/django/commit/6e657e2c404a96e744748209e896d8a69c15fdf2 url
- https://github.com/django/django/commit/7791e5c050cebf86d868c5dab7092185b125fdc9 url
- https://github.com/django/django package
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-1.yaml url
- https://web.archive.org/web/20080725022008/http://secunia.com/advisories/30291 url
- https://web.archive.org/web/20081012011038/http://secunia.com/advisories/30250 url
- https://web.archive.org/web/20170222015451/http://securitytracker.com/id?1020028 url
- https://web.archive.org/web/20200228153339/http://www.securityfocus.com/bid/29209 url
- http://www.djangoproject.com/weblog/2008/may/14/security url