CVE-2020-13596
python-django: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7
CVE-2020-13596 is fixed in 3 products on 1 platform, first by python-django 1:1.11.11-1ubuntu1.9, released June 3, 2020. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0290
86th percentile
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python-django · Ubuntu 18.04.6 LTS (bionic) | 1:1.11.11-1ubuntu1.9 | python-django 1:1.11.11-1ubuntu1.9 | Jun 3, 2020 |
| python-django-common · Ubuntu 18.04.6 LTS (bionic) | 1:1.11.11-1ubuntu1.9 | python-django-common 1:1.11.11-1ubuntu1.9 | Jun 3, 2020 |
| python3-django · Ubuntu 18.04.6 LTS (bionic) | 1:1.11.11-1ubuntu1.9 | python3-django 1:1.11.11-1ubuntu1.9 | Jun 3, 2020 |
| python3-django · Ubuntu 20.04 LTS (focal) | 2:2.2.12-1ubuntu0.1 | python3-django 2:2.2.12-1ubuntu0.1 | Jun 3, 2020 |