A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the     browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from     user input. This allows a user who can control those strings to inject malicious <script> tags, leading to     a cross-site-scripting (XSS) vulnerability. (CVE-2020-25626)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the
    browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from
    user input. This allows a user who can control those strings to inject malicious <script> tags, leading to
    a cross-site-scripting (XSS) vulnerability. (CVE-2020-25626)

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dsa-5186 advisory.

    Two cross-site scripting vulnerabilities were discovered in the Django Rest Framework, a toolkit to build     web APIs. For the oldstable distribution (buster), this problem has been fixed in version 3.9.0-1+deb10u1.
    The stable distribution (bullseye) is not affected. We recommend that you upgrade your djangorestframework     packages. For the detailed security status of djangorestframework please refer to its security tracker     page at: https://security-tracker.debian.org/tracker/djangorestframework

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-djangorestframework fixes the following issues :

Update to 3.11.2

  - Security: Drop urlize_quoted_links template tag in     favour of Django's built-in urlize. Removes a XSS     vulnerability for some kinds of content in the browsable     API. (boo#1177205, CVE-2020-25626)

  - update Django for APIs book to 3.0 edition

  - decode base64 credentials as utf8; adjust tests

  - Remove compat urls for Django < 2.0

ID	Name	Product	Family	Type	Severity
258900	Linux Distros Unpatched Vulnerability : CVE-2020-25626	Nessus	Misc.	Local	medium
414757	SCA: security update for djangorestframework (GHSA-fx83-3ph3-9j2q)	Tenable Cloud Security	SCA Checks	Local	medium
414757	SCA: security update for djangorestframework (GHSA-fx83-3ph3-9j2q)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
163413	Debian DSA-5186-1 : djangorestframework - security update	Nessus	Debian Local Security Checks	Local	medium
146858	openSUSE Security Update : python-djangorestframework (openSUSE-2021-322)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2020-25626

medium

Tenable Plugins

medium

medium

medium

medium

medium