An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

- Security fix for CVE-2020-7471.

  - Security fix for CVE-2020-9402.

  - Security fix for CVE-2020-13254.

  - Security fix for CVE-2020-13596.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Django, a high-level Python web development framework, did not properly sanitize input. This would allow a remote attacker to perform SQL injection attacks, Cross-Site Scripting (XSS) attacks, or leak sensitive information.

Django security release reports :

CVE-2020-13254: Potential data leakage via malformed memcached keys

In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. In order to avoid this vulnerability, key validation is added to the memcached cache backends.

CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget

Query parameters for the admin ForeignKeyRawIdWidget were not properly URL encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query parameters are correctly URL encoded.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4381-1 advisory.

    Dan Palmer discovered that Django incorrectly validated memcached cache keys. A remote attacker could     possibly use this issue to cause a denial of service and obtain sensitive information. (CVE-2020-13254)

    Jon Dufresne discovered that Django incorrectly encoded query parameters for the admin     ForeignKeyRawIdWidget. A remote attacker could possibly use this issue to perform XSS attacks.
    (CVE-2020-13596)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
137686	Fedora 32 : python-django (2020-c2639662af)	Nessus	Fedora Local Security Checks	critical
137680	Fedora 31 : python-django (2020-2e7d30f7aa)	Nessus	Fedora Local Security Checks	critical
137673	Debian DSA-4705-1 : python-django - security update	Nessus	Debian Local Security Checks	high
137166	FreeBSD : Django -- multiple vulnerabilities (597d02ce-a66c-11ea-af32-080027846a02)	Nessus	FreeBSD Local Security Checks	medium
137133	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-4381-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2020-13596

medium

Tenable Plugins

critical

critical

high

medium

medium