CVE-2020-25626

Katalog CVE

CVSS 6.1 · Medium EPSS 1,3%

Kerentanan Improper Input Validation pada encode django rest framework, redhat ceph storage +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

Rincian

Terbit di NVD

30 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1878635 issue tracking · advisory vendor
• https://security.netapp.com/advisory/ntap-20201016-0003/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5186 advisory pihak ketiga