CVE-2024-11404: Django Filer Unrestricted Upload of File with Dangerous Type
(updated )
Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.
References
- github.com/advisories/GHSA-j4v3-wwwx-5gqv
- github.com/django-cms/django-filer/commit/f8209a6507680661bd134cd30878993b79ef3344
- iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323
- iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability
- nvd.nist.gov/vuln/detail/CVE-2024-11404
- pypi.org/project/django-filer
- siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1864
- www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field
- www.usom.gov.tr/bildirim/tr-24-1864
Code Behaviors & Features
Detect and mitigate CVE-2024-11404 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →