| Package | Affected versions | Patched versions |
|---|---|---|
| django-cms | ≥ 3.4.0, < 3.4.7≥ 3.5.0, < 3.5.4≥ 3.6.0, < 3.6.1≥ 3.7.0, < 3.7.4 | 3.4.73.5.43.6.13.7.4 |
| django cms | ≥ 3.4.0, < 3.4.7≥ 3.5.0, < 3.5.4≥ 3.6.0, < 3.6.1≥ 3.7.0, < 3.7.4 | 3.4.73.5.43.6.13.7.4 |
Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free