Vulnerability · Published Feb 3, 2022 · Assigned by mitre
CVE-2022-22818
Medium 6.1
In plain English
A medium-severity security flaw in the py3-django package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)3.4%top 11.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | py3-django | 3.2.12-r0 | ALPINE-CVE-2022-22818 |
| Alpine:v3.21 | py3-django | 3.2.12-r0 | ALPINE-CVE-2022-22818 |
| Alpine:v3.22 | py3-django | 3.2.12-r0 | ALPINE-CVE-2022-22818 |
| Alpine:v3.23 | py3-django | 3.2.12-r0 | ALPINE-CVE-2022-22818 |
| Alpine:v3.24 | py3-django | 3.2.12-r0 | ALPINE-CVE-2022-22818 |
| Debian:12 | python-django | 2:3.2.12-1 | DEBIAN-CVE-2022-22818 |
| Debian:13 | python-django | 2:3.2.12-1 | DEBIAN-CVE-2022-22818 |
| Debian:14 | python-django | 2:3.2.12-1 | DEBIAN-CVE-2022-22818 |
| PyPI | django | 2.2.27 | GHSA-95rw-fx8r-36v6 |
| PyPI | django | 3.2.12 | GHSA-95rw-fx8r-36v6 |
| PyPI | django | 4.0.2 | GHSA-95rw-fx8r-36v6 |
| PyPI | django | 2.2.27, 3.2.12, 4.0.2 | PYSEC-2022-19 |
| Rocky Linux:8 | libdb | 0:5.3.28-42.el8_4 | RLSA-2022:5498 |
| Rocky Linux:8 | libdb | 0:5.3.28-42.el8_4 | RLSA-2022:8506 |