// For flags

CVE-2024-21520

djangorestframework: Cross-site Scripting (XSS) via break_long_headers

Severity Score

5.3
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Las versiones del paquete djangorestframework anteriores a la 3.15.2 son vulnerables a Cross-site Scripting (XSS) a través del filtro de plantilla break_long_headers debido a una sanitización inadecuada de la entrada antes de dividir y unir con etiquetas <br>.

A vulnerability was found in the djangorestframework package. Cross-site scripting occurs via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

*Credits: ch4n3-yoon
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Passive
System
Vulnerable | Subsequent
Confidentiality
None
Low
Integrity
Low
Low
Availability
None
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-12-22 CVE Reserved
  • 2024-05-26 First Exploit
  • 2024-06-26 CVE Published
  • 2024-06-26 EPSS Updated
  • 2024-12-31 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Django-rest-framework
Search vendor "Django-rest-framework"
 Django Rest Framework
Search vendor "Django-rest-framework" for product "Django Rest Framework"
*-
Affected
Redhat
Search vendor "Redhat"
 Ansible Automation Platform
Search vendor "Redhat" for product "Ansible Automation Platform"
*-
Affected
Redhat
Search vendor "Redhat"
 Ansible Automation Platform Developer
Search vendor "Redhat" for product "Ansible Automation Platform Developer"
*-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected