views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external
    redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com)
    attack. (CVE-2021-46898)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0017-1 advisory.

  - views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external     redirection with startswith(/) but this does not consider a protocol-relative URL (e.g., //example.com)     attack. (CVE-2021-46898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0384-1 advisory.

  - views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external     redirection with startswith(/) but this does not consider a protocol-relative URL (e.g., //example.com)     attack. (CVE-2021-46898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
413533	SCA: security update for django-grappelli (GHSA-9x43-5qcq-h79q)	Tenable Cloud Security	SCA Checks	Local	medium
413533	SCA: security update for django-grappelli (GHSA-9x43-5qcq-h79q)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
188004	openSUSE 15 Security Update : python-django-grappelli (openSUSE-SU-2024:0017-1)	Nessus	SuSE Local Security Checks	Local	medium
186505	openSUSE 15 Security Update : python-django-grappelli (openSUSE-SU-2023:0384-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2021-46898

medium

Tenable Plugins

medium

medium

medium

medium