The remote host is using Django, a high-level Python web framework designed for rapid development of database-driven websites. 

The administration application included with the version of Django installed on the remote host fails to sanitize the URL before using it to generate dynamic HTML output.  An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

遠端主機正在使用 Django，這是專為加速開發由資料庫驅動的網站而設計的高階 Python Web 架構。 

遠端主機上安裝的 Django 版本隨附的管理應用程式未清理 URL 便將其用於產生動態 HTML 輸出。攻擊者可能會利用此弱點，將任意 HTML 和指令碼插入使用者的瀏覽器，以便在受影響網站的安全性內容中執行。

リモートホストは、データベース駆動型Webサイトの迅速な開発のために設計された、高レベルのPython WebフレームワークであるDjangoを使用しています。 

リモートホストにインストールされているバージョンのDjangoに含まれている管理アプリケーションが、動的HTML出力を生成するために使用する前に、URLをサニタイズできません。攻撃者がこれを利用して、任意のHTMLおよびスクリプトコードをユーザーのブラウザに注入し、影響を受けるサイトのセキュリティコンテキスト内で実行させることがあります。

- Mon May 19 2008 Michel Salim <salimma at     fedoraproject.org> - 0.96.2-1

    - XSS security update: CVE-2008-2302 (bz# 442757-60)

    - Sat Apr 5 2008 Michel Salim <salimma at       fedoraproject.org> - 0.96.1-2

    - Package .egg-info file on Fedora >= 9

    - Thu Nov 1 2007 Michel Salim <michel.sylvan at       gmail.com> 0.96.1-1

    - i18n security update: CVE-2007-5712, bz#357051

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon May 19 2008 Michel Salim <salimma at     fedoraproject.org> - 0.96.2-1

    - XSS security update: CVE-2008-2302 (bz# 442757-60)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Django project reports :

The Django administration application will, when accessed by a user who is not sufficiently authenticated, display a login form and ask the user to provide the necessary credentials before displaying the requested page. This form will be submitted to the URL the user attempted to access, by supplying the current request path as the value of the form's 'action' attribute.

The value of the request path was not being escaped, creating an opportunity for a cross-site scripting (XSS) attack by leading a user to a URL which contained URL-encoded HTML and/or JavaScript in the request path.

- Bug #446402 - CVE-2008-2302 Django: administration     application XSS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
32319	Django Administration Application Login Form XSS	Nessus	CGI abuses : XSS	2008/5/15	2022/4/11	medium
32319	Django 管理應用程式登入表單 XSS	Nessus	CGI abuses : XSS	2008/5/15	2022/4/11	medium
32319	Django管理アプリケーションのログインフォームのXSS	Nessus	CGI abuses : XSS	2008/5/15	2022/4/11	medium
32409	Fedora 7 : Django-0.96.2-1.fc7 (2008-4191)	Nessus	Fedora Local Security Checks	2008/5/22	2021/1/11	medium
32413	Fedora 9 : Django-0.96.2-1.fc9 (2008-4267)	Nessus	Fedora Local Security Checks	2008/5/22	2021/1/11	medium
32350	FreeBSD : django -- XSS vulnerability (f49ba347-2190-11dd-907c-001c2514716c)	Nessus	FreeBSD Local Security Checks	2008/5/16	2021/1/6	medium
32411	Fedora 8 : Django-0.96.2-1.fc8 (2008-4248)	Nessus	Fedora Local Security Checks	2008/5/22	2021/1/11	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium