CVE-2024-21520

EUVD-2024-2061
Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
django-rest-frameworkdjango_rest_framework
𝑥
< 3.15.2
ADP
Debian logo
Debian Releases
Debian Product
Codename
djangorestframework
bookworm
no-dsa
bullseye
no-dsa
forky
3.16.1-3
fixed
sid
3.16.1-3
fixed
trixie
3.16.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
djangorestframework
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
mantic
ignored
noble
needs-triage
oracular
not-affected
plucky
not-affected
questing
not-affected
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/encode/django-rest-framework/commit/3b41f0124194430da957b119712978fa2266b642
https://github.com/encode/django-rest-framework/pull/9435
https://security.snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORK-7252137
https://github.com/encode/django-rest-framework/commit/3b41f0124194430da957b119712978fa2266b642
https://github.com/encode/django-rest-framework/compare/3.15.1...3.15.2
https://github.com/encode/django-rest-framework/pull/9435
https://security.snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORK-7252137