Miggo Logo
Miggo Vulnerability Database
→
CVE-2010-3082

CVE-2010-3082:
Cross-site scripting in django

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2010-3082
GHSA ID
GHSA-fxpg-gg9g-76gj
EPSS Score
0.60339%
CWE
CWE-79
Published
7/23/2018
Updated
9/16/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
Djangopip>= 1.2, < 1.2.21.2.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from unescaped insertion of CSRF token values from cookies into HTML outputs. The patch diffs show: 1) In csrf.py's add_csrf_field, the token value was concatenated directly into HTML until escape() was added. 2) In defaulttags.py's CSRF token template tag, similar unescaped insertion occurred. Both locations handled user-controllable cookie data (csrfmiddlewaretoken) without proper sanitization, enabling XSS payload injection. The test case changes (using '<1>' token) confirm the exploit scenario required escaping these values.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ross-sit* s*riptin* (XSS) vuln*r**ility in *j*n*o *.*.x ***or* *.*.* *llows r*mot* *tt**k*rs to inj**t *r*itr*ry w** s*ript or *TML vi* * *sr*mi**l*w*r*tok*n (*k* *sr*_tok*n) *ooki*.

Reasoning

T** vuln*r**ility st*mm** *rom un*s**p** ins*rtion o* *SR* tok*n v*lu*s *rom *ooki*s into *TML outputs. T** p*t** *i**s s*ow: *) In *sr*.py's ***_*sr*_*i*l*, t** tok*n v*lu* w*s *on**t*n*t** *ir**tly into *TML until *s**p*() w*s *****. *) In ****ultt