Medium severity6.1NVD Advisory· Published Jun 3, 2019· Updated Jun 17, 2026
CVE-2019-12308
CVE-2019-12308
Description
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
DjangoPyPI | >= 1.11a1, < 1.11.21 | 1.11.21 |
DjangoPyPI | >= 2.1a1, < 2.1.9 | 2.1.9 |
DjangoPyPI | >= 2.2a1, < 2.2.2 | 2.2.2 |
Affected products
13- Django/Djangodescription
- ghsa-coords12 versionspkg:pypi/djangopkg:rpm/opensuse/python-Django4&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/python-Django6&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/python-Django&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/python-Django&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/python-Django&distro=openSUSE%20Tumbleweedpkg:rpm/suse/python-Django1&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/python-Django1&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/python-Django&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/python-Django&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/python-Django&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/python-Django&distro=SUSE%20Package%20Hub%2015%20SP1
>= 1.11a1, < 1.11.21+ 11 more
- (no CPE)range: >= 1.11a1, < 1.11.21
- (no CPE)range: < 4.2.14-1.1
- (no CPE)range: < 6.0-1.1
- (no CPE)range: < 2.2.4-lp151.2.3.1
- (no CPE)range: < 2.0.7-150000.1.27.1
- (no CPE)range: < 3.2.7-2.3
- (no CPE)range: < 1.11.20-3.6.1
- (no CPE)range: < 1.11.20-3.6.1
- (no CPE)range: < 1.11.23-3.12.1
- (no CPE)range: < 1.11.23-3.12.1
- (no CPE)range: < 1.11.23-3.12.1
- (no CPE)range: < 2.2.4-bp151.3.3.1
Patches
Vulnerability mechanics
References
31- www.openwall.com/lists/oss-security/2019/06/03/2nvdMailing ListThird Party AdvisoryWEB
- docs.djangoproject.com/en/dev/releases/1.11.21/nvdVendor Advisory
- docs.djangoproject.com/en/dev/releases/2.1.9/nvdVendor Advisory
- docs.djangoproject.com/en/dev/releases/2.2.2/nvdVendor Advisory
- docs.djangoproject.com/en/dev/releases/security/nvdVendor Advisory
- github.com/advisories/GHSA-7rp2-fm2h-wchjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-12308ghsaADVISORY
- www.djangoproject.com/weblog/2019/jun/03/security-releases/nvdVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlnvdWEB
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlnvdWEB
- docs.djangoproject.com/en/dev/releases/1.11.21ghsaWEB
- docs.djangoproject.com/en/dev/releases/2.1.9ghsaWEB
- docs.djangoproject.com/en/dev/releases/2.2.2ghsaWEB
- docs.djangoproject.com/en/dev/releases/securityghsaWEB
- github.com/django/django/commit/09186a13d975de6d049f8b3e05484f66b01ece62ghsaWEB
- github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b5a673ghsaWEB
- github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52bghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-79.yamlghsaWEB
- groups.google.com/forum/ghsaWEB
- lists.debian.org/debian-lts-announce/2019/06/msg00001.htmlnvdWEB
- lists.debian.org/debian-lts-announce/2019/07/msg00001.htmlnvdWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5GghsaWEB
- seclists.org/bugtraq/2019/Jul/10nvdWEB
- security.gentoo.org/glsa/202004-17nvdWEB
- usn.ubuntu.com/4043-1ghsaWEB
- www.debian.org/security/2019/dsa-4476nvdWEB
- www.djangoproject.com/weblog/2019/jun/03/security-releasesghsaWEB
- www.securityfocus.com/bid/108559nvd
- groups.google.com/forum/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/nvd
- usn.ubuntu.com/4043-1/nvd
News mentions
0No linked articles in our index yet.