Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-6050

CVE-2025-6050: Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function

4.8

CVSS Score
4.0

Basic Information

CVE ID
CVE-2025-6050
GHSA ID
GHSA-7pr5-w74r-jjj7
EPSS Score
0.17715%
CWE
CWE-79
Published
6/17/2025
Updated
6/17/2025
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Package NameEcosystemVulnerable VersionsFirst Patched Version
Mezzaninepip< 6.1.16.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly mentions the displayable_links_js function as the source of the Stored XSS. The provided commit patch confirms this by showing a modification within this function in the file mezzanine/core/views.py. The patch introduces the escape() function from django.utils.html to sanitize the title variable, which is derived from obj.title or obj.titles. Before this change, the unsanitized title was used, leading to the XSS vulnerability when the /admin/displayable_links.js endpoint was accessed. Therefore, mezzanine.core.views.displayable_links_js is the vulnerable function as it processed and outputted unsanitized user-supplied data (blog post titles).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

M*zz*nin* *MS, in v*rsions prior to *.*.*, *ont*ins * Stor** *ross-Sit* S*riptin* (XSS) vuln*r**ility in t** **min int*r****. T** vuln*r**ility *xists in t** "*ispl*y**l*_links_js" *un*tion, w*i** **ils to prop*rly s*nitiz* *lo* post titl*s ***or* in

Reasoning

T** vuln*r**ility **s*ription *xpli*itly m*ntions t** `*ispl*y**l*_links_js` *un*tion *s t** sour** o* t** Stor** XSS. T** provi*** *ommit p*t** *on*irms t*is *y s*owin* * mo*i*i**tion wit*in t*is *un*tion in t** *il* `m*zz*nin*/*or*/vi*ws.py`. T** p