{"id":"CVE-2010-3082","published":"2010-09-14T18:00:00Z","modified":"2024-08-07T02:55:46Z","title":"Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01917,"percentile":0.7979,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.ubuntu.com/usn/USN-1004-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/61729","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.securityfocus.com/bid/43116","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://marc.info/?l=oss-security&m=128403961700444&w=2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=632239","tags":["x_refsource_CONFIRM"]},{"url":"http://www.djangoproject.com/weblog/2010/sep/08/security-release/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.0,"factors":[{"name":"EPSS percentile","points":15.96}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.2, <1.2.2"],"patched":["1.2.2"],"from":["GHSA-fxpg-gg9g-76gj","PYSEC-2010-12"],"provenance":"source"}],"euvd":{"id":"EUVD-2010-0001","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2010-3082","children":[{"from":"CVE-2010-3082","to":"CVE-2011-0696","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/middleware/csrf.py"],"commits":["https://github.com/django/django/commit/7f84657b6b2243cc787bdb9f296710c8d13ad0bd","https://github.com/django/django/commit/408c5c873ce1437c7eee9544ff279ecbad7e150a","https://github.com/django/django/commit/818e70344e7193f6ebc73c82ed574e6ce3c91afc"],"basis":"rarely changed file"}]},{"from":"CVE-2010-3082","to":"CVE-2013-4315","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/template/defaulttags.py"],"commits":["https://github.com/django/django/commit/7f84657b6b2243cc787bdb9f296710c8d13ad0bd","https://github.com/django/django/commit/87d2750b39f6f2d54b7047225521a44dcd37e896","https://github.com/django/django/commit/988b61c550d798f9a66d17ee0511fb7a9a7f33ca"],"basis":"shared function","functions":["render"]}]}],"packageHistory":[{"cve":"CVE-2008-3909","published":"2008-09-04","fixed":"1.1","kev":false},{"cve":"CVE-2009-2659","published":"2009-08-04","fixed":"1.1","kev":false},{"cve":"CVE-2009-3695","published":"2009-10-13","fixed":"1.1.1","kev":false},{"cve":"CVE-2010-3082","published":"2010-09-14","fixed":"1.2.2","kev":false},{"cve":"CVE-2010-4534","published":"2011-01-10","fixed":"1.2.4","kev":false,"link":{"from":"CVE-2010-3082","to":"CVE-2010-4534","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.2.2","toFixed":"1.2.4","daysApart":118}]}},{"cve":"CVE-2010-4535","published":"2011-01-10","fixed":"1.2.4","kev":false,"link":{"from":"CVE-2010-3082","to":"CVE-2010-4535","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.2.2","toFixed":"1.2.4","daysApart":118}]}},{"cve":"CVE-2011-0696","published":"2011-02-14","fixed":"1.2.5","kev":false}],"package":"PyPI:Django"}}