Search for vulnerabilities
Vulnerability details: VCID-wtpw-b4cs-aaaf
Vulnerability ID VCID-wtpw-b4cs-aaaf
Aliases CVE-2019-12308
GHSA-7rp2-fm2h-wchj
PYSEC-2019-79
PYSEC-2019-9
Summary An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
Status Published
Exploitability 0.5
Weighted Severity 7.1
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12308.html
cvssv3 4.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-12308.json
epss 0.00689 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01040 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01040 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01040 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01040 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01040 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01040 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01040 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.0127 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01468 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01468 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01468 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.01468 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.02234 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.02234 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.02234 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
epss 0.02234 https://api.first.org/data/v1/epss?cve=CVE-2019-12308
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1715915
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12308
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12781
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6975
cvssv3.1 6.1 https://docs.djangoproject.com/en/dev/releases/1.11.21
generic_textual MODERATE https://docs.djangoproject.com/en/dev/releases/1.11.21
cvssv3.1 6.1 https://docs.djangoproject.com/en/dev/releases/2.1.9
generic_textual MODERATE https://docs.djangoproject.com/en/dev/releases/2.1.9
cvssv3.1 6.1 https://docs.djangoproject.com/en/dev/releases/2.2.2
generic_textual MODERATE https://docs.djangoproject.com/en/dev/releases/2.2.2
cvssv3.1 3.7 https://docs.djangoproject.com/en/dev/releases/security
generic_textual MODERATE https://docs.djangoproject.com/en/dev/releases/security
generic_textual Medium https://docs.djangoproject.com/en/dev/releases/security/
cvssv3 6.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-7rp2-fm2h-wchj
cvssv3.1 3.7 https://github.com/django/django
generic_textual MODERATE https://github.com/django/django
cvssv3.1 6.1 https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62
generic_textual MODERATE https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62
cvssv3.1 6.1 https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673
generic_textual MODERATE https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673
cvssv3.1 6.1 https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b
generic_textual MODERATE https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b
cvssv3.1 6.1 https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yaml
cvssv3.1 6.1 https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8
generic_textual MODERATE https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8
cvssv3.1 6.1 https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html
cvssv3.1 6.1 https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html
cvssv3.1 6.1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2019-12308
cvssv3 6.1 https://nvd.nist.gov/vuln/detail/CVE-2019-12308
cvssv3.1 7.5 https://seclists.org/bugtraq/2019/Jul/10
generic_textual HIGH https://seclists.org/bugtraq/2019/Jul/10
archlinux Medium https://security.archlinux.org/AVG-969
cvssv3.1 8.8 https://security.gentoo.org/glsa/202004-17
generic_textual HIGH https://security.gentoo.org/glsa/202004-17
generic_textual Medium https://ubuntu.com/security/notices/USN-4043-1
cvssv3.1 5.3 https://usn.ubuntu.com/4043-1
generic_textual MODERATE https://usn.ubuntu.com/4043-1
generic_textual Low https://usn.ubuntu.com/usn/usn-4043-1
cvssv3.1 7.5 https://www.debian.org/security/2019/dsa-4476
generic_textual HIGH https://www.debian.org/security/2019/dsa-4476
cvssv3.1 6.1 https://www.djangoproject.com/weblog/2019/jun/03/security-releases
generic_textual MODERATE https://www.djangoproject.com/weblog/2019/jun/03/security-releases
generic_textual Low https://www.djangoproject.com/weblog/2019/jun/03/security-releases/
cvssv3.1 6.1 http://www.openwall.com/lists/oss-security/2019/06/03/2
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2019/06/03/2
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12308.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-12308.json
https://api.first.org/data/v1/epss?cve=CVE-2019-12308
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12308
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12781
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6975
https://docs.djangoproject.com/en/dev/releases/1.11.21
https://docs.djangoproject.com/en/dev/releases/1.11.21/
https://docs.djangoproject.com/en/dev/releases/2.1.9
https://docs.djangoproject.com/en/dev/releases/2.1.9/
https://docs.djangoproject.com/en/dev/releases/2.2.2
https://docs.djangoproject.com/en/dev/releases/2.2.2/
https://docs.djangoproject.com/en/dev/releases/security
https://docs.djangoproject.com/en/dev/releases/security/
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/django/django
https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62
https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673
https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b
https://github.com/django/django/commit/deeba6d92006999fee9adfbd8be79bf0a59e8008
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yaml
https://groups.google.com/forum/#%21topic/django-announce/GEbHU7YoVz8
https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8
https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html
https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/
https://seclists.org/bugtraq/2019/Jul/10
https://security.gentoo.org/glsa/202004-17
https://ubuntu.com/security/notices/USN-4043-1
https://usn.ubuntu.com/4043-1
https://usn.ubuntu.com/4043-1/
https://usn.ubuntu.com/usn/usn-4043-1
https://www.debian.org/security/2019/dsa-4476
https://www.djangoproject.com/weblog/2019/jun/03/security-releases
https://www.djangoproject.com/weblog/2019/jun/03/security-releases/
http://www.openwall.com/lists/oss-security/2019/06/03/2
http://www.securityfocus.com/bid/108559
1715915 https://bugzilla.redhat.com/show_bug.cgi?id=1715915
929927 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929927
ASA-201906-2 https://security.archlinux.org/ASA-201906-2
AVG-969 https://security.archlinux.org/AVG-969
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
CVE-2019-12308 https://nvd.nist.gov/vuln/detail/CVE-2019-12308
GHSA-7rp2-fm2h-wchj https://github.com/advisories/GHSA-7rp2-fm2h-wchj
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-12308.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://docs.djangoproject.com/en/dev/releases/1.11.21
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://docs.djangoproject.com/en/dev/releases/2.1.9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://docs.djangoproject.com/en/dev/releases/2.2.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://docs.djangoproject.com/en/dev/releases/security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-12308
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-12308
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://seclists.org/bugtraq/2019/Jul/10
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202004-17
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://usn.ubuntu.com/4043-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.debian.org/security/2019/dsa-4476
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.djangoproject.com/weblog/2019/jun/03/security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2019/06/03/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.56019
EPSS Score 0.00689
Published At March 29, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.