CVE-2021-46898

Advisory

Django-grappelli 2.15.2 includes a fix for CVE-2021-46898: views/switch.py in django-grappelli before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.
https://github.com/sehmaschine/django-grappelli/issues/975

Affected package

Affected versions

Fixed versions

Vulnerability changelog

views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack. See CVE-2021-46898.


MISC:https://github.com/sehmaschine/django-grappelli/commit/4ca94bcda0fa2720594506853d85e00c8212968f: https://github.com/sehmaschine/django-grappelli/commit/4ca94bcda0fa2720594506853d85e00c8212968f
MISC:https://github.com/sehmaschine/django-grappelli/compare/2.15.1...2.15.2: https://github.com/sehmaschine/django-grappelli/compare/2.15.1...2.15.2
MISC:https://github.com/sehmaschine/django-grappelli/issues/975: https://github.com/sehmaschine/django-grappelli/issues/975
MISC:https://github.com/sehmaschine/django-grappelli/pull/976: https://github.com/sehmaschine/django-grappelli/pull/976

Resources

• https://github.com/sehmaschine/django-grappelli/commit/4ca94bcda0fa2720594506853d85e00c8212968f
• https://github.com/sehmaschine/django-grappelli/compare/2.15.1...2.15.2
• https://github.com/sehmaschine/django-grappelli/issues/975
• https://github.com/sehmaschine/django-grappelli/pull/976
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46898