| Package | Affected versions | Patched versions |
|---|---|---|
| django-grappelli | < 2.15.2 | 2.15.2 |
| django grappelli | < 2.15.2 | 2.15.2 |
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free