Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/djangorestframework@3.1.2
Typepypi
Namespace
Namedjangorestframework
Version3.1.2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.11.2
Latest_non_vulnerable_version3.11.2
Affected_by_vulnerabilities
0
url VCID-95q1-5qy3-vydk
vulnerability_id VCID-95q1-5qy3-vydk
summary A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
references
0
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1878635
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1878635
1
reference_url https://github.com/advisories/GHSA-fx83-3ph3-9j2q
reference_id
reference_type
scores
url https://github.com/advisories/GHSA-fx83-3ph3-9j2q
2
reference_url https://security.netapp.com/advisory/ntap-20201016-0003/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20201016-0003/
fixed_packages
0
url pkg:pypi/djangorestframework@3.11.2
purl pkg:pypi/djangorestframework@3.11.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/djangorestframework@3.11.2
aliases CVE-2020-25626, GHSA-fx83-3ph3-9j2q, PYSEC-2020-263
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-95q1-5qy3-vydk
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/djangorestframework@3.1.2