CVE-2010-3082

Django 1.2.x < 1.2.2 - Cross-Site Scripting via csrfmiddlewaretoken Cookie

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.

References (6)

Core 6
Core References
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1004-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/61729
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/43116
Mailing List mailing-list x_refsource_mlist
http://marc.info/?l=oss-security&m=128403961700444&w=2
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=632239
Patch, Vendor Advisory x_refsource_confirm
http://www.djangoproject.com/weblog/2010/sep/08/security-release/

Scores

EPSS 0.0192
EPSS Percentile 77.7%

Details

CWE
CWE-79
Status published
Products (3)
djangoproject/django 1.2.1 (2 CPE variants)
djangoproject/django 1.2.2
pypi/Django 1.2 - 1.2.2PyPI
Published Sep 14, 2010
Tracked Since Feb 18, 2026