Bug 1878635 (CVE-2020-25626) - CVE-2020-25626 django-rest-framework: XSS Vulnerability in API viewer
Summary: CVE-2020-25626 django-rest-framework: XSS Vulnerability in API viewer
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-25626
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat1878712 Red Hat1878709 Embargoed1878710 Embargoed1878711 Red Hat1879392 Red Hat1879393
Blocks: Embargoed1877552
TreeView+ depends on / blocked
 
Reported: 2020-09-14 08:52 UTC by Borja Tarraso
Modified: 2021-02-16 19:16 UTC (History)
13 users (show)

Fixed In Version: django-rest-framework 3.12.0, django-rest-framework 3.11.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Django REST Framework. When using the browseable API viewer, the Django REST Framework fails to properly escape certain strings that come from user input. This flaw allows a user to control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Clone Of:
Environment:
Last Closed: 2020-09-30 20:21:41 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4136 0 None None None 2020-09-30 14:13:29 UTC
Red Hat Product Errata RHSA-2020:4137 0 None None None 2020-09-30 14:15:30 UTC

Description Borja Tarraso 2020-09-14 08:52:40 UTC 
A flaw was found in Django REST Framework. When using the browseable API viewer, DRF fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Comment 6 Borja Tarraso 2020-09-17 06:54:07 UTC 
Acknowledgments:

Name: Lior Ethan (Red Hat), Ryan Petrello (Red Hat)
Comment 11 errata-xmlrpc 2020-09-30 14:13:27 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.7 for RHEL 7

Via RHSA-2020:4136 https://access.redhat.com/errata/RHSA-2020:4136
Comment 12 errata-xmlrpc 2020-09-30 14:14:52 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.6 for RHEL 7

Via RHSA-2020:4137 https://access.redhat.com/errata/RHSA-2020:4137
Comment 13 Product Security DevOps Team 2020-09-30 20:21:41 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25626
Comment 14 RaTasha Tillery-Smith 2020-12-15 16:06:04 UTC 
Statement:

In Red Hat Ceph Storage 2, python-djangorestframework is embedded in calamari-server. However, calamari-server is no longer supported and will not be fixed.
Note You need to log in before you can comment on or make changes to this bug.