diff --git a/advisories/github-reviewed/2022/05/GHSA-gv98-g628-m9x5/GHSA-gv98-g628-m9x5.json b/advisories/github-reviewed/2022/05/GHSA-gv98-g628-m9x5/GHSA-gv98-g628-m9x5.json index 396079106ea..933f734c8f6 100644 --- a/advisories/github-reviewed/2022/05/GHSA-gv98-g628-m9x5/GHSA-gv98-g628-m9x5.json +++ b/advisories/github-reviewed/2022/05/GHSA-gv98-g628-m9x5/GHSA-gv98-g628-m9x5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gv98-g628-m9x5", - "modified": "2023-08-03T21:14:50Z", + "modified": "2024-09-18T19:55:30Z", "published": "2022-05-17T03:20:49Z", "aliases": [ "CVE-2015-0220" @@ -9,13 +9,20 @@ "summary": "Django Cross-site Scripting Vulnerability", "details": "The `django.util.http.is_safe_url` function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a `\\njavascript:` URL.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ecosystem_specific": { "affected_functions": [ @@ -39,7 +46,7 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ecosystem_specific": { "affected_functions": [ @@ -51,7 +58,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "1.6.0" + "introduced": "1.6" }, { "fixed": "1.6.10" @@ -63,7 +70,7 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ecosystem_specific": { "affected_functions": [ @@ -75,7 +82,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "1.7.0" + "introduced": "1.7" }, { "fixed": "1.7.3" @@ -102,10 +109,18 @@ "type": "WEB", "url": "https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89" }, + { + "type": "PACKAGE", + "url": "https://github.com/django/django" + }, { "type": "WEB", "url": "https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.18.txt#L34-L46" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-5.yaml" + }, { "type": "WEB", "url": "https://web.archive.org/web/20150128111656/http://secunia.com/advisories/62285" @@ -126,10 +141,6 @@ "type": "WEB", "url": "https://www.djangoproject.com/weblog/2015/jan/13/security" }, - { - "type": "WEB", - "url": "http://advisories.mageia.org/MGASA-2015-0026.html" - }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html"