{"action":"Upgrade django-cms to 3.4.7 or later.","affected":[{"fixed":"3.7.4","introduced":"3.7.0"},{"fixed":"3.6.1","introduced":"3.6.0"},{"fixed":"3.5.4","introduced":"3.5.0"},{"fixed":"3.4.7","introduced":"3.4.0"}],"component":"django-cms","cve_ids":["CVE-2021-44649"],"ecosystem":"PyPI","epss":0.00617,"exploited":false,"fixed_versions":["3.7.4","3.6.1","3.5.4","3.4.7"],"ghsa_id":"GHSA-hx7c-qpfq-xcrp","id":"tcs_01M5KFMNEJS4M6RXW3QW9MJN8R","modified_at":"2024-09-16T22:07:01.820464Z","published_at":"2022-01-13T20:10:53Z","references":["https://osv.dev/vulnerability/GHSA-hx7c-qpfq-xcrp","https://nvd.nist.gov/vuln/detail/CVE-2021-44649","https://github.com/advisories/GHSA-hx7c-qpfq-xcrp","https://github.com/divio/django-cms","https://github.com/pypa/advisory-database/tree/main/vulns/django-cms/PYSEC-2022-7.yaml","https://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability","https://www.django-cms.org/en/blog/2020/07/22/django-cms-security-updates-1"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-hx7c-qpfq-xcrp","url":"https://osv.dev/vulnerability/GHSA-hx7c-qpfq-xcrp"}],"summary":"Cross-site Scripting in django-cms"}