There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached
    backend does not perform key validation, passing malformed cache keys could result in a key collision, and
    potential data leakage. (CVE-2020-13254)

  - An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by
    the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS
    attack. (CVE-2020-13596)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by
    the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS
    attack. (CVE-2020-13596)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4381-1 advisory.

    Dan Palmer discovered that Django incorrectly validated memcached cache keys. A remote attacker could     possibly use this issue to cause a denial of service and obtain sensitive information. (CVE-2020-13254)

    Jon Dufresne discovered that Django incorrectly encoded query parameters for the admin     ForeignKeyRawIdWidget. A remote attacker could possibly use this issue to perform XSS attacks.
    (CVE-2020-13596)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Django, a high-level Python web development framework, did not properly sanitize input. This would allow a remote attacker to perform SQL injection attacks, Cross-Site Scripting (XSS) attacks, or leak sensitive information.

- Security fix for CVE-2020-7471.

  - Security fix for CVE-2020-9402.

  - Security fix for CVE-2020-13254.

  - Security fix for CVE-2020-13596.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Django security release reports :

CVE-2020-13254: Potential data leakage via malformed memcached keys

In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. In order to avoid this vulnerability, key validation is added to the memcached cache backends.

CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget

Query parameters for the admin ForeignKeyRawIdWidget were not properly URL encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query parameters are correctly URL encoded.

ID	Name	Product	Family	Published	Updated	Severity
406653	Alpine: multiple py3-django packages: security update to 3.0.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
408974	SCA: security update for Django (GHSA-2m34-jcjv-45xf)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	medium
408974	SCA: security update for Django (GHSA-2m34-jcjv-45xf)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	medium
406653	Alpine: multiple py3-django packages: security update to 3.0.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
137133	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-4381-1)	Nessus	Ubuntu Local Security Checks	6/4/2020	8/27/2024	medium
137673	Debian DSA-4705-1 : python-django - security update	Nessus	Debian Local Security Checks	6/22/2020	9/25/2020	high
137680	Fedora 31 : python-django (2020-2e7d30f7aa)	Nessus	Fedora Local Security Checks	6/22/2020	3/6/2024	critical
137166	FreeBSD : Django -- multiple vulnerabilities (597d02ce-a66c-11ea-af32-080027846a02)	Nessus	FreeBSD Local Security Checks	6/5/2020	9/28/2020	medium
137686	Fedora 32 : python-django (2020-c2639662af)	Nessus	Fedora Local Security Checks	6/22/2020	3/6/2024	critical

Detections

Analytics

Plugins Search

high

medium

medium

high

medium

high

critical

medium

critical