CVE-2022-22818

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.djangoproject.com/en/4.0/releases/security/Patch, Third Party Advisory
https://groups.google.com/forum/#%21forum/django-announce
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
https://security.netapp.com/advisory/ntap-20220221-0003/Third Party Advisory
https://www.debian.org/security/2022/dsa-5254Third Party Advisory
https://www.djangoproject.com/weblog/2022/feb/01/security-releases/Exploit, Patch, Third Party Advisory
https://docs.djangoproject.com/en/4.0/releases/security/Patch, Third Party Advisory
https://groups.google.com/forum/#%21forum/django-announce
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
https://security.netapp.com/advisory/ntap-20220221-0003/Third Party Advisory
https://www.debian.org/security/2022/dsa-5254Third Party Advisory
https://www.djangoproject.com/weblog/2022/feb/01/security-releases/Exploit, Patch, Third Party Advisory

Timeline

Published: Feb 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-228197.8NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a CVE-2022-228205.5Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipie CVE-2022-228214.4NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admi CVE-2022-228229.8addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228239.8build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228249.8defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228258.8lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228268.8nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228278.8storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228287.5An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared CVE-2022-228319.8An issue was discovered in Servisnet Tessa 0.0.2. An attacker can add a new sysadmin user via a manipulation of the Authorization HTTP heade CVE-2022-228329.8An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request.