CVE-2020-25626CWE-20

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2

published September 30, 2020

CVSS
—
EPSS
1%
Percentile
70.2
In the wild
Unconfirmed
What it is

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01297 · 70.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2020-09-30T19:24Z
EPSS history
Timeline
  • 30 SEP 19:24Z
    A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2
    cvelistv5