CVE-2020-25626: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2020-25626 is a medium (CVSS 6.1) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 69.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 30-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.30%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
+0.01 pp
From 1.29% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Opensuse3 products
- python-djangorestframework-test&distro=openSUSE Leap 15.2< 3.11.2-lp152.2.3.1
- python-djangorestframework&distro=openSUSE Leap 15.2< 3.11.2-lp152.2.3.1
- python-djangorestframework&distro=openSUSE Tumbleweed< 3.18.0-1.1
Debian2 products
- djangorestframework< 3.12.1-1
- debian_linuxEOL11.0
Suse2 products
- python-djangorestframework-test&distro=SUSE Package Hub 15 SP2< 3.11.2-bp152.2.3.1
- python-djangorestframework&distro=SUSE Package Hub 15 SP2< 3.11.2-bp152.2.3.1
Encode1 product
- django_rest_framework< 3.12.0
PyPI1 product
- djangorestframework< 3.11.2
Redhat1 product
- ceph_storage2.0
Ubuntu1 product
- djangorestframeworkAll versions (No fix recorded)
7 vendors · 11 products
References
15 links
- lists.opensuse.org/archives/…Advisory
Show all 15 references
- lists.opensuse.org/archives/…Advisory