VYPR
← All advisories
Moderate severityNVD Advisory· Published May 23, 2008· Updated Apr 23, 2026

CVE-2008-2302

CVE-2008-2302

Description

Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
DjangoPyPI
>= 0.91, < 0.91.20.91.2
DjangoPyPI
>= 0.95, < 0.95.30.95.3
DjangoPyPI
>= 0.96, < 0.96.20.96.2

Affected products

3
  • Djangoproject/Django3 versions
    cpe:2.3:a:django_project:django:0.91:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:django_project:django:0.91:*:*:*:*:*:*:*
    • cpe:2.3:a:django_project:django:0.95:*:*:*:*:*:*:*
    • cpe:2.3:a:django_project:django:0.96:*:*:*:*:*:*:*

Patches

3
6e657e2c404a

Backport [7521] to 0.91-bugfixes per security policy; announcement and security bugfix release will be forthcoming.

https://github.com/django/djangoJames BennettMay 14, 2008via ghsa
commit
1 file changed · +2 −1
  • django/contrib/admin/views/decorators.py+2 −1 modified
    @@ -2,6 +2,7 @@
 from django.conf.settings import SECRET_KEY
 from django.models.auth import users
 from django.utils import httpwrappers
+from django.utils.html import escape
 from django.utils.translation import gettext_lazy
 import base64, datetime, md5
 import cPickle as pickle
@@ -21,7 +22,7 @@ def _display_login_form(request, error_message=''):
         post_data = _encode_post_data({})
     return render_to_response('admin/login', {
         'title': _('Log in'),
-        'app_path': request.path,
+        'app_path': escape(request.path),
         'post_data': post_data,
         'error_message': error_message
     }, context_instance=DjangoContext(request))
50ce7fb57d79

Backport [7521] to 0.95-bugfixes per security policy; announcement and security bugfix release will be forthcoming.

https://github.com/django/djangoJames BennettMay 14, 2008via ghsa
commit
1 file changed · +2 −1
  • django/contrib/admin/views/decorators.py+2 −1 modified
    @@ -3,6 +3,7 @@
 from django.contrib.auth.models import User
 from django.contrib.auth import authenticate, login
 from django.shortcuts import render_to_response
+from django.utils.html import escape
 from django.utils.translation import gettext_lazy
 import base64, datetime, md5
 import cPickle as pickle
@@ -22,7 +23,7 @@ def _display_login_form(request, error_message=''):
         post_data = _encode_post_data({})
     return render_to_response('admin/login.html', {
         'title': _('Log in'),
-        'app_path': request.path,
+        'app_path': escape(request.path),
         'post_data': post_data,
         'error_message': error_message
     }, context_instance=template.RequestContext(request))
7791e5c050ce

Backport [7521] to 0.96-bugfixes per security policy; announcement and security bugfix release will be forthcoming.

https://github.com/django/djangoJames BennettMay 14, 2008via ghsa
commit
1 file changed · +2 −1
  • django/contrib/admin/views/decorators.py+2 −1 modified
    @@ -3,6 +3,7 @@
 from django.contrib.auth.models import User
 from django.contrib.auth import authenticate, login
 from django.shortcuts import render_to_response
+from django.utils.html import escape
 from django.utils.translation import gettext_lazy
 import base64, datetime, md5
 import cPickle as pickle
@@ -22,7 +23,7 @@ def _display_login_form(request, error_message=''):
         post_data = _encode_post_data({})
     return render_to_response('admin/login.html', {
         'title': _('Log in'),
-        'app_path': request.path,
+        'app_path': escape(request.path),
         'post_data': post_data,
         'error_message': error_message
     }, context_instance=template.RequestContext(request))

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

18

News mentions

0

No linked articles in our index yet.