CVE-2021-25986

描述

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.

如何修補 CVE-2021-25986

要修補 CVE-2021-25986,請將受影響套件升級到下列已修補版本。

• —升級至 0.7.9 或更新版本
• —升級至 9eaccc7519e4206a4d2f22640882f0737b2da9c5 或更新版本

CVE-2021-25986 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 0.0.20, < 0.7.9
• from 0, < 9eaccc7519e4206a4d2f22640882f0737b2da9c5 | >= 0.0.20, < 0.7.9

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-3m3h-v9hv-9j4h
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-25986
• PATCHgithub.com/django-wiki/django-wiki
• WEBgithub.com/django-wiki/django-wiki/commit/9eaccc7519e4206a4d2f22640882f0737b2da9c5