Vulnerability Description
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
CVSS Score
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Djangoproject | Django | >= 2.2, < 2.2.27 |
| Fedoraproject | Fedora | 35 |
| Debian | Debian Linux | 11.0 |
Related Weaknesses (CWE)
References
- https://docs.djangoproject.com/en/4.0/releases/security/PatchThird Party Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20220221-0003/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5254Third Party Advisory
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ExploitPatchThird Party Advisory
- https://docs.djangoproject.com/en/4.0/releases/security/PatchThird Party Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20220221-0003/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5254Third Party Advisory
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ExploitPatchThird Party Advisory
FAQ
What is CVE-2022-22818?
CVE-2022-22818 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
How severe is CVE-2022-22818?
CVE-2022-22818 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-22818?
Check the references section above for vendor advisories and patch information. Affected products include: Djangoproject Django, Fedoraproject Fedora, Debian Debian Linux.