Vulnerability Details CVE-2021-44649
Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 67.1%
CVSS Severity
CVSS v3 Score 5.4
CVSS v2 Score 3.5
References
- https://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability/
- https://www.django-cms.org/en/blog/2020/07/22/django-cms-security-updates-1/
- https://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability/
- https://www.django-cms.org/en/blog/2020/07/22/django-cms-security-updates-1/
Products affected by CVE-2021-44649
-
cpe:2.3:a:django-cms:django_cms:*