« Volver al listado

CVE-2024-11404

Estado: AplazadaMedia (5.5)—

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.

This issue affects django Filer: from 3 before 3.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Django CMS Association — Django FilerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-11404",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-11404",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-20T14:47:10.954922Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "iletisim@usom.gov.tr",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "iletisim@usom.gov.tr",
      "affectedData": [
        {
          "vendor": "django CMS Association",
          "product": "django Filer",
          "versions": [
            {
              "status": "affected",
              "version": "3",
              "lessThan": "3.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-20T12:15:18.640",
  "references": [
    {
      "url": "https://iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323/",
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://pypi.org/project/django-filer/",
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1864",
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field/",
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://www.usom.gov.tr/bildirim/tr-24-1864",
      "source": "iletisim@usom.gov.tr"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "iletisim@usom.gov.tr",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.\n\nThis issue affects django Filer: from 3 before 3.3."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de carga sin restricciones de archivos con tipos peligrosos, validación de entrada incorrecta, neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico) en Django CMS Association. Django Filer permite la manipulación de datos de entrada y XSS almacenado. Este problema afecta a Django Filer: desde la versión 3 hasta la 3.3."
    }
  ],
  "lastModified": "2026-06-17T06:57:41.820",
  "sourceIdentifier": "iletisim@usom.gov.tr"
}