CVE-2008-2302
Django Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
- Record
CVE-2008-2302- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
- Record
CVE-2008-2302- Updated
- 2026-11-02
EUVDEUVD-2008-0002 No score
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
- Record
EUVD-2008-0002- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-54qj-48vx-cr9f
Django Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
- Record
GHSA-54qj-48vx-cr9f- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-54qj-48vx-cr9f
Django Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
- Record
GHSA-54qj-48vx-cr9f- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
- Record
CVE-2008-2302- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-2302 No score
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
- Record
DEBIAN-CVE-2008-2302- Updated
- 2026-11-02
OSVPYSEC-2008-1 No score
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
- Record
PYSEC-2008-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
0.91 up to 0.91.2 | 0.91.2 |
djangoPyPI |
0.95 up to 0.95.3 | 0.95.3 |
djangoPyPI |
0.96 up to 0.96.2 | 0.96.2 |
python-djangoDebian:12 |
before 0.96.2-1 | 0.96.2-1 |
python-djangoDebian:13 |
before 0.96.2-1 | 0.96.2-1 |
python-djangoDebian:14 |
before 0.96.2-1 | 0.96.2-1 |
djangoPyPI |
before 1.1, plus listed versions 1.0.11.0.21.0.31.0.4 |
1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2302 is a medium vulnerability (CVSS 4.3) in Django Project Django, published May 23, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in django 0.91.2.
References
secunia.com/advisories/30250
securitytracker.com/id?1020028
exchange.xforce.ibmcloud.com/vulnerabilities/42396
securityfocus.com/bid/29209
vupen.com/english/advisories/2008/1618
Show 13 moreShow less
djangoproject.com/weblog/2008/may/14/security
nvd.nist.gov/vuln/detail/CVE-2008-2302
github.com/django/django/commit/50ce7fb57d79e8940ccf6e2781f2f01df029b5c5
web.archive.org/web/20080725022008/http://secunia.com/advisories/30291
security-tracker.debian.org/tracker/CVE-2008-2302