CVE-2024-11406
Stored XSS in django CMS Attributes Fields
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.
This issue affects django CMS Attributes Fields: before 4.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Stored XSS in django CMS Attributes Fields
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.
This issue affects django CMS Attributes Fields: before 4.0.
- Record
CVE-2024-11406- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-3386
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.
This issue affects django CMS Attributes Fields: before 4.0.
- Record
EUVD-2024-3386- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vxcv-4xvf-pc22
django CMS Attributes Field Cross-site Scripting
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0.
- Record
GHSA-vxcv-4xvf-pc22- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.
This issue affects django CMS Attributes Fields: before 4.0.
- Record
CVE-2024-11406- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Stored XSS in django CMS Attributes Fields
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.
This issue affects django CMS Attributes Fields: before 4.0.
- Record
CVE-2024-11406- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-vxcv-4xvf-pc22
django CMS Attributes Field Cross-site Scripting
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0.
- Record
GHSA-vxcv-4xvf-pc22- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-1303
django CMS Attributes Field Cross-site Scripting
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0.
- Record
PYSEC-2026-1303- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangocms-attributes-fieldPyPI |
before 4.0.0 | 4.0.0 |
djangocms-attributes-fieldPyPI |
before 4.0.0, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 13 moreShow less0.0.60.1.00.1.10.1.20.2.00.3.00.4.01.0.01.1.01.2.02.0.02.1.03.0.0 |
4.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-11406 is a medium vulnerability (CVSS 6.9) in Django Cms Association Cms Attributes Fields, published November 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in djangocms-attributes-field 4.0.0.
References
usom.gov.tr/bildirim/tr-24-1864
django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field
iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability
github.com/django-cms/djangocms-attributes-field/commit/fe68d29ab78db5885bc31b67cf0537f1f02b33ad
pypi.org/project/djangocms-attributes-field
siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1864