VYPR
← All advisories
High severityOSV Advisory· Published Jan 9, 2019· Updated Aug 4, 2024

CVE-2019-3498

CVE-2019-3498

Description

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Django's 404 error page fails to neutralize malicious content in crafted URLs, allowing content spoofing in versions before 1.11.18, 2.0.10, and 2.1.5.

Vulnerability

In Django versions 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, the django.views.defaults.page_not_found() view does not properly neutralize special elements in the URL before including it in the generated 404 error page [2][3]. This allows an attacker to inject arbitrary HTML or script content into the error page.

Exploitation

An attacker can craft a URL that contains malicious content, such as HTML tags or JavaScript. When a user visits that URL and receives a 404 response, the injected content is rendered as part of the error page without escaping [2][4]. The attacker requires no authentication; the exploit relies on the user navigating to the crafted URL (e.g., via a link). If the user does not examine the URL carefully, they may be misled by the spoofed content.

Impact

Successful exploitation results in content spoofing. The attacker can display arbitrary content within the context of the trusted Django website's 404 page, potentially leading to phishing attacks or defacement [3]. No direct disclosure of data or remote code execution occurs, but the vulnerability undermines the integrity of the site's error responses.

Mitigation

The issue is fixed in Django 1.11.18, 2.0.10, and 2.1.5, released on January 4, 2019 [2][4]. Users should upgrade to these versions or later. There are no known workarounds for affected versions; upgrading is the recommended mitigation.

References
  1. NVD - CVE-2019-3498
  2. CVE-2019-3498 - GitHub Advisory Database
  3. advisory-database/vulns/django/PYSEC-2019-17.yaml at main · pypa/advisory-database

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
DjangoPyPI
>= 1.11a1, < 1.11.181.11.18
DjangoPyPI
>= 2.0a1, < 2.0.102.0.10
DjangoPyPI
>= 2.1a1, < 2.1.52.1.5

Affected products

383

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

17

News mentions

0

No linked articles in our index yet.