CVE-2021-25986: Cross-site Scripting in django-wiki
Summary
CVE-2021-25986: Cross-site Scripting in django-wiki. Affects wiki versions >= 0.0.20, < 0.7.9. Fixed in 0.7.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django-wiki is an open-source Python package available on PyPI. It provides a wiki application for Django projects, allowing users to create and edit pages. The package is widely used for collaborative content creation and management. However, versions 0.0.20 to 0.7.8 of django-wiki are vulnerable to Stored Cross-Site Scripting (XSS) in the Notifications Section.
Vulnerability Detail
The vulnerability allows an attacker with edit page access to inject a JavaScript payload into the title field. When a victim receives a notification about changes made in the application, the payload in the notification panel renders and loads external JavaScript. This can lead to the execution of malicious code in the victim's browser, potentially compromising their session, stealing sensitive information, or performing unauthorized actions.
How To Fix
Minimum fixed version
0.7.9
This is the first release that contains the fix.
pip install --upgrade "wiki==0.7.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the Notifications Section in the application. This can be achieved by modifying the application's code or configuration to remove or disable the functionality responsible for sending notifications. However, this workaround should only be considered as a temporary measure until the package is upgraded to a secure version.
Conclusion
In conclusion, django-wiki versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in the Notifications Section. Upgrading to version 0.7.9 or later is recommended to fix this vulnerability. If immediate upgrade is not possible, disabling the Notifications Section can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wiki →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various consequences, including session hijacking, data theft, and unauthorized actions on behalf of the victim.
Users of django-wiki versions 0.0.20 to 0.7.8 are affected by this vulnerability. If your application relies on these versions of django-wiki, it is recommended to upgrade to a secure version.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the vulnerability promptly to mitigate potential risks.
No, this vulnerability requires an attacker to have access to edit pages within the django-wiki application. It cannot be exploited remotely without prior access to the application.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level. It is important to address this vulnerability to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for wiki.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
