Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05eDQzLTVxY3EtaDc5cc4AA2nF

Django Grappelli Open Redirect vulnerability

views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.

Permalink: https://github.com/advisories/GHSA-9x43-5qcq-h79q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05eDQzLTVxY3EtaDc5cc4AA2nF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 7 months ago
Updated: 6 months ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-9x43-5qcq-h79q, CVE-2021-46898
References: Repository: https://github.com/sehmaschine/django-grappelli
Blast Radius: 20.1

Affected Packages

pypi:django-grappelli
Dependent packages: 7
Dependent repositories: 1,956
Downloads: 202,472 last month
Affected Version Ranges: >= 0, < 2.15.2
Fixed in: 2.15.2
All affected versions: 2.1.1, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8, 2.3.9, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.7.1, 2.7.2, 2.7.3, 2.8.1, 2.8.2, 2.8.3, 2.9.1, 2.10.1, 2.10.2, 2.10.3, 2.10.4, 2.11.1, 2.11.2, 2.12.1, 2.12.2, 2.12.3, 2.12.4, 2.13.1, 2.13.2, 2.13.3, 2.13.4, 2.14.1, 2.14.2, 2.14.3, 2.14.4, 2.15.1
All unaffected versions: 2.15.2, 2.15.3, 2.15.4, 2.15.5, 2.15.6, 2.15.7, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 4.0.1