CVE-2020-19002: PYSEC-2021-343 - Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componen

CVE-2020-19002 · Severity: low · CVSS 3.1 · Published 2021-08-27

Technologies: Mezzanine (PyPI). Vendors: PyPI.

Executive brief

Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632.

Affected products

PyPI Mezzanine

Related threats

PYSEC-2026-1627 - Mezzanine allows attackers to bypass access control mechanisms
PYSEC-2026-1626 - Mezzanine allows attackers to bypass access controls via manipulating the Host header
Mezzanine CMS stored XSS in blog post component
Mezzanine CMS stored XSS in displayable_links_js function
Mezzanine CMS persistent XSS in Forms module via malicious filename