{"id":"CVE-2024-11319","aliases":["EUVD-2024-0036","GHSA-gv5h-5655-h4mv","PYSEC-2024-124"],"status":"published","title":"Stored XSS in Open Source Project \"django-cms\"","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).\n\nThis issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00537,"percentile":0.45563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-11-18T11:53:04Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"PyPI","package":"django-cms","fixed_in":["3.11.9","4.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.7"},{"fixed":"3.11.9"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.2"},{"fixed":"4.1.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.7"},{"fixed":"3.11.9"}]}],"versions":["3.11.7","3.11.8"]},{"source":"osv","ecosystem":"PyPI","package":"django-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.2"},{"fixed":"4.1.4"}]}],"versions":["4.1.2","4.1.3"]}],"products":[{"vendor":"django cms association","product":"django-cms"},{"vendor":"django-cms","product":"django_cms"}],"references":[{"url":"https://www.usom.gov.tr/bildirim/tr-24-1859","tags":["government-resource","broken-link","Third Party Advisory","web"]},{"url":"https://github.com/django-cms/django-cms/commit/241d1cbe47a68f5d271ce4d27ad5e32e2c360ec3","tags":["Patch","fix","web"]},{"url":"https://www.django-cms.org/en/blog/2024/11/13/django-cms-security-update/","tags":["Vendor Advisory","article","advisory"]},{"url":"https://iltosec.com/blog/post/django-cms-413-stored-xss-vulnerability-exploiting-the-page-title-field/","tags":["Exploit","article","evidence"]},{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1859","tags":["government-resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11319","tags":["advisory"]},{"url":"https://iltosec.com/blog/post/django-cms-413-stored-xss-vulnerability-exploiting-the-page-title-field","tags":["web"]},{"url":"https://www.django-cms.org/en/blog/2024/11/13/django-cms-security-update","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django-cms/PYSEC-2024-124.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gv5h-5655-h4mv","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11319.json","tags":["advisory"]},{"url":"https://github.com/django-cms/django-cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-11319","title":"Stored XSS in Open Source Project \"django-cms\"","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).\n\nThis issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.","status":"published","published":"2024-11-18T11:53:04.244Z","modified":"2026-06-02T06:37:32.463Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2024-0036","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).\n\nThis issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.","status":"published","published":"2024-11-18T11:53:04Z","modified":"2026-06-02T06:37:32Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:56.977213Z"}],"ghsa":[{"id":"GHSA-gv5h-5655-h4mv","title":"django CMS Cross-Site Scripting (XSS)","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).This issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.","status":"published","published":"2024-11-18T12:30:43Z","modified":"2026-06-09T10:55:03Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2024-11319","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).\n\nThis issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.","status":"published","published":"2024-11-18T12:15:17.853Z","modified":"2026-06-17T06:57:31.783Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"CVE-2024-11319","title":"Stored XSS in Open Source Project \"django-cms\"","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).\n\nThis issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.","status":"published","published":"2024-11-18T11:53:04.244Z","modified":"2026-10-28T02:30:41.620304209Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"GHSA-gv5h-5655-h4mv","title":"django CMS Cross-Site Scripting (XSS)","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).This issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.","status":"published","published":"2024-11-18T12:30:43Z","modified":"2026-06-10T18:44:48Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"PYSEC-2024-124","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).This issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.","status":"withdrawn","published":"2024-11-18T12:15:00Z","modified":"2026-06-10T17:00:47.713543846Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:53.837392Z"}]}}