Cross Site Scripting vulnerability in django-jsonform's admin form.

published 2022-06-10 4y ago modified 2024-12-07 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Description

django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks.

This only affects the admin pages where the django-jsonform is rendered.

### Mitigation

Upgrade to django-jsonform version 2.10.1 or later.

### For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/bhch/django-jsonform/issues). * Email the maintainer at `Bharat Chauhan <tell.bhch@gmail.com>`.

Patch / fix

fixed in 1

pypi django-jsonform 2.10.1

Is GHSA-x9jp-4w8m-4f3c in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
pypi	django-jsonform	<2.10.1	2.10.1

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page

References

Sources

GitHub Advisory GHSA-x9jp-4w8m-4f3c

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.