Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-4526

CVE-2022-4526: django-photologue vulnerable to Cross-site Scripting

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-4526
GHSA ID
GHSA-287q-jfcp-9vhv
EPSS Score
0.24621%
CWE
CWE-79
Published
12/15/2022
Updated
9/16/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
django-photologuepip<= 3.15.13.16

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems directly from the template's use of the '|safe' filter on the user-controlled 'object.caption' field. The commit 960cb06 explicitly removes this filter to enable auto-escaping. The added test case verifies HTML is properly escaped in titles and captions. While not a traditional code function, the template variable rendering with unsafe filtering constitutes the vulnerable implementation point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in *j*n*o-p*otolo*u* up to *.**.* *n* *l*ssi*i** *s pro*l*m*ti*. *****t** *y t*is issu* is som* unknown *un*tion*lity o* t** *il* p*otolo*u*/t*mpl*t*s/p*otolo*u*/p*oto_**t*il.*tml o* t** *ompon*nt ****ult T*mpl*t* **n*l*r. T

Reasoning

T** vuln*r**ility st*ms *ir**tly *rom t** t*mpl*t*'s us* o* t** '|s***' *ilt*r on t** us*r-*ontroll** 'o*j**t.**ption' *i*l*. T** *ommit ******* *xpli*itly r*mov*s t*is *ilt*r to *n**l* *uto-*s**pin*. T** ***** t*st **s* v*ri*i*s *TML is prop*rly *s*