CVE:CVE-2020-13596
CNNVD:CNNVD-202006-294
Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。
Django 2.2.13之前的2.2版本和33.0.7之前的3.0版本中存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade djangoproject django to a higher version than 2.2.13,3.0.7,and avoid the version [2.2,2.2.13),[3.0,3.0.7); Upgrade fedoraproject fedora to a higher version than 32,and avoid the version 32; Upgrade canonical ubuntu_linux to a higher version than 14.04,16.04,18.04,19.10,20.04,and avoid the version 14.04,16.04,18.04,19.10,20.04; Upgrade netapp sra_plugin to a higher version than -; Upgrade netapp steelstore_cloud_integrated_storage to a higher version than -; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade oracle zfs_storage_appliance_kit to a higher version than 8.8,and avoid the version 8.8