Quick answers
- Is CVE-2020-13596 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-13596 being exploited in the wild.
- How severe is CVE-2020-13596?
- Low severity, with a CVSS score of 3.1, published 3 June 2020.
- Which products and versions are affected?
- Django (PyPI) ECOSYSTEM:introduced=2.2,fixed=2.2.13,introduced=3.0,fixed=3.0.7, ECOSYSTEM:introduced=2.2a1,fixed=2.2.13.
- Is there a fix for CVE-2020-13596?
- Yes. Django (PyPI): upgrade to 2.2.13, 3.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-13596 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2020-13596?
- Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Django (PyPI): upgrade to 2.2.13, 3.0.7 or later
pip install "Django>=3.0.7"
Technical details
The vulnerability is a stored/reflected XSS (CWE-79) in Django's admin ForeignKeyRawIdWidget, where query parameters were not properly URL encoded before being rendered in HTML. The vulnerable component is part of Django's built-in admin interface. The attack vector is network-based and does not require special privileges beyond access to the admin interface. An attacker who can craft and submit a malicious request containing unencoded query parameters can cause arbitrary JavaScript to execute in the context of other admin users' browsers. The issue was fixed in Django 2.2.13 and 3.0.7 by properly URL-encoding query parameters.
Affected products
- Django Django 2.2 before 2.2.13, 3.0 before 3.0.7
Identifiers
- CVE-2020-13596
- GHSA-2m34-jcjv-45xf
- PYSEC-2020-32
Timeline
- 2020-06-03: disclosed
- 2020-06-03: patched: Fixes released for Django 2.2.13 and 3.0.7