CVE-2021-25986
Cross-site Scripting in django-wiki
5.4
MEDIUM
CVSS 3.1
EPSS 0.19%
Description
In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.
How to fix CVE-2021-25986
To remediate CVE-2021-25986, upgrade the affected package to a fixed version below.
- —upgrade to 0.7.9 or later
- —upgrade to 9eaccc7519e4206a4d2f22640882f0737b2da9c5 or later
Is CVE-2021-25986 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- >= 0.0.20, < 0.7.9
- from 0, < 9eaccc7519e4206a4d2f22640882f0737b2da9c5 | >= 0.0.20, < 0.7.9
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| osv | CVSS 3.1 | MEDIUM5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |