{"id":"CVE-2019-12308","aliases":["ALPINE-CVE-2019-12308","DEBIAN-CVE-2019-12308","DLA-1814-1","DSA-4476-1","EUVD-2019-0043","GHSA-7rp2-fm2h-wchj","PYSEC-2019-79","SUSE-SU-2019:2034-1","SUSE-SU-2019:2257-1","SUSE-SU-2019:2335-1","SUSE-SU-2024:2817-1","UBUNTU-CVE-2019-12308","USN-4043-1","openSUSE-SU-2019:1839-1","openSUSE-SU-2019:1872-1","openSUSE-SU-2024:11205-1","openSUSE-SU-2024:13887-1","openSUSE-SU-2024:14208-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:11235-1","openSUSE-SU-2026:11248-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"Django Cross-site Scripting in AdminURLFieldWidget","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02402,"percentile":0.84254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-06-03T14:00:00Z","modified":"2026-11-03T06:32:29Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.11.21","2.1.9","2.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"py-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"py-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"py-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"py-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["1.11.21-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1:1.11.21-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1:1.11.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1:1.11.21-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"python-django","fixed_in":["1.7.11-1+deb8u5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","fixed_in":["1.11.20-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","fixed_in":["1.11.20-3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11a1"},{"fixed":"1.11.21"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1a1"},{"fixed":"2.1.9"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2a1"},{"fixed":"2.2.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.21-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.21-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.21-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.11-1+deb8u5"}]}],"versions":["1.7.10-1","1.7.11-1","1.7.11-1+deb8u1","1.7.11-1+deb8u2","1.7.11-1+deb8u3","1.7.11-1+deb8u4","1.7.7-1","1.7.7-1+deb8u1","1.7.7-1+deb8u2","1.7.7-1+deb8u3","1.7.7-1+deb8u4","1.7.7-1+deb8u5","1.7.9-1"]},{"source":"osv","ecosystem":"Debian:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.7-2+deb9u5"}]}],"versions":["1:1.10.7-2","1:1.10.7-2+deb9u1","1:1.10.7-2+deb9u2","1:1.10.7-2+deb9u3","1:1.10.7-2+deb9u4"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11a1"},{"fixed":"1.11.21"}]}],"versions":["1.11","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.2","1.11.20","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11a1","1.11b1","1.11rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1a1"},{"fixed":"2.1.9"}]}],"versions":["2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1a1","2.1b1","2.1rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2a1"},{"fixed":"2.2.2"}]}],"versions":["2.2","2.2.1","2.2a1","2.2b1","2.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"fixed":"2.1.9"},{"introduced":"1.11"},{"fixed":"1.11.21"},{"introduced":"2.2"},{"fixed":"2.2.2"}]}],"versions":["1.11","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.20","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.2","2.2.1"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.20-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.20-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150000.1.27.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9","1.6.11-0ubuntu1.3+esm10","1.6.11-0ubuntu1.3+esm11","1.6.11-0ubuntu1.3+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8","1.8.7-1ubuntu5.15+esm9","1.8.7-1ubuntu5.15+esm10","1.8.7-1ubuntu5.15+esm11","1.8.7-1ubuntu5.15+esm12","1.8.7-1ubuntu5.15+esm13"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.4"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.9"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.4"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-lp151.2.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-bp151.3.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-2.3"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-2.1"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.14-1.1"}]}],"bundled":51},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-4.1"}]}],"bundled":59},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/03/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://groups.google.com/forum/#%21topic/django-announce/GEbHU7YoVz8","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/1.11.21/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/2.1.9/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/2.2.2/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2019/jun/03/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"http://www.securityfocus.com/bid/108559","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4043-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4476","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Jul/10","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202004-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12308","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8","tags":["web"]},{"url":"https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62","tags":["web"]},{"url":"https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673","tags":["web"]},{"url":"https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/1.11.21","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/2.1.9","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/2.2.2","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2019/jun/03/security-releases","tags":["web"]},{"url":"https://usn.ubuntu.com/4043-1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7rp2-fm2h-wchj","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-12308","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12308","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192034-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136468","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1139945","tags":["report"]},{"url":"https://bugzilla.suse.com/1142880","tags":["report"]},{"url":"https://bugzilla.suse.com/1142882","tags":["report"]},{"url":"https://bugzilla.suse.com/1142883","tags":["report"]},{"url":"https://bugzilla.suse.com/1142885","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14235","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192335-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242817-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198398","tags":["report"]},{"url":"https://bugzilla.suse.com/1228629","tags":["report"]},{"url":"https://bugzilla.suse.com/1228630","tags":["report"]},{"url":"https://bugzilla.suse.com/1228631","tags":["report"]},{"url":"https://bugzilla.suse.com/1228632","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-12308","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4043-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12781","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ/#3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW/#5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12308","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-03T16:24:31Z","modified":"2024-08-04T23:17:39.619Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-0043","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-03T16:24:31Z","modified":"2024-08-04T23:17:39Z","updated_at":"2026-11-03T02:40:46.416719Z"}],"ghsa":[{"id":"GHSA-7rp2-fm2h-wchj","title":"Django Cross-site Scripting in AdminURLFieldWidget","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-10T18:43:25Z","modified":"2024-09-20T16:03:28Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2019-12308","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-03T17:29:01.213Z","modified":"2026-06-17T02:14:23.963Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:14.729983Z"}],"osv":[{"id":"ALPINE-CVE-2019-12308","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-03T17:29:01.213Z","modified":"2026-11-03T06:32:29.216356481Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2019-12308","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-03T17:29:01.213Z","modified":"2026-10-24T10:30:16.735467909Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12308","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-03T17:29:01.213Z","modified":"2026-09-21T07:01:46.347027037Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-7rp2-fm2h-wchj","title":"Django Cross-site Scripting in AdminURLFieldWidget","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-10T18:43:25Z","modified":"2024-09-20T16:09:01.600161Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"UBUNTU-CVE-2019-12308","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-03T14:00:00Z","modified":"2026-10-01T14:01:34.818746435Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1814-1","title":"python-django - security update","status":"published","published":"2019-06-05T00:00:00Z","modified":"2026-03-09T01:22:34.833525Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4476-1","title":"python-django - security update","status":"published","published":"2019-07-05T00:00:00Z","modified":"2026-03-09T02:08:43.019707Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:1839-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-11358: Fixed prototype pollution.\n- CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880).\n- CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882).\n- CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883).\n- CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885).\n\nNon-security issues fixed:\n\n- Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.\n  ","status":"published","published":"2019-08-08T15:57:07Z","modified":"2026-02-04T02:34:28.956376Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1872-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-11358: Fixed prototype pollution.\n- CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880).\n- CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882).\n- CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883).\n- CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885).\n\nNon-security issues fixed:\n\n- Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.\n  \nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-08-14T09:13:06Z","modified":"2026-02-04T04:08:53.819357Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11205-1","title":"python36-Django-3.2.7-2.3 on GA media","description":"These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:14.367485Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13887-1","title":"python310-Django-4.2.11-2.1 on GA media","description":"These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:27.577316Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14208-1","title":"python310-Django4-4.2.14-1.1 on GA media","description":"These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-19T00:00:00Z","modified":"2026-02-04T02:20:42.476564Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11235-1","title":"python313-Django4-4.2.30-4.1 on GA media","description":"These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.244458214Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11248-1","title":"python313-Django-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.179829219Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2019-79","description":"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","status":"published","published":"2019-06-03T17:29:00Z","modified":"2023-11-08T04:01:03.504446Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2019:2034-1","title":"Security update for python-Django1","description":"This update for python-Django1 fixes the following issues:\n\n- CVE-2019-12308: Fixed an improper validatation of the clickable 'Current URL' link in AdminURLFieldWidget \n  which could have allowed attackers to perform XSS attacks (bsc#1136468).\n","status":"published","published":"2019-08-01T14:25:23Z","modified":"2026-02-04T03:00:56.375253Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2257-1","title":"Security update for python-Django","description":"This update for python-Django to version 1.11.23 fixes the following issues:\n\n- CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).\n- CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).\n- CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).\n- CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).\n","status":"published","published":"2019-09-02T07:03:33Z","modified":"2026-02-04T03:40:58.849461Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2335-1","title":"Security update for python-Django1","description":"This update for python-Django1 to version 1.11.23 fixes the following issues:\n\n- CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).\n- CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).\n- CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).\n- CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).\n","status":"published","published":"2019-09-09T10:09:00Z","modified":"2026-02-04T02:25:54.98095Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2024:2817-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2024-42005: Fixed SQL injection in QuerySet.values() and values_list() (bsc#1228629)\n- CVE-2024-41989: Fixed Memory exhaustion in django.utils.numberformat.floatformat() (bsc#1228630)\n- CVE-2024-41990: Fixed denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228631)\n- CVE-2024-41991: Fixed another denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228632)\n- CVE-2022-28346: Fixed SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398)\n- CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)\n","status":"published","published":"2024-08-07T13:32:44Z","modified":"2026-02-04T04:25:08.273999Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-4043-1","title":"python-django vulnerabilities","description":"It was discovered that Django incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10 and Ubuntu 19.04.\n(CVE-2019-12308)\n\nGavin Wahl discovered that Django incorrectly handled HTTP detection when used behind a reverse-proxy. Client requests made via HTTP would cause incorrect API results and would not be redirected to HTTPS, contrary to expectations. (CVE-2019-12781)\n","status":"published","published":"2019-07-01T11:02:10Z","modified":"2026-04-27T15:27:35.561042Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}