{"action":"Upgrade django-cms to 3.4.7 or later.","affected":[{"fixed":"3.4.7","introduced":"3.4.0"},{"fixed":"3.5.4","introduced":"3.5.0"},{"fixed":"3.6.1","introduced":"3.6.0"},{"fixed":"3.7.4","introduced":"3.7.0"}],"component":"django-cms","cve_ids":["CVE-2021-44649"],"ecosystem":"PyPI","epss":0.00617,"exploited":false,"fixed_versions":["3.4.7","3.5.4","3.6.1","3.7.4"],"ghsa_id":"GHSA-hx7c-qpfq-xcrp","id":"tcs_01M5KGJ2YKD3JCKRFBK2MKCXJ2","modified_at":"2023-11-08T04:07:17.907342Z","published_at":"2022-01-12T13:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-7","https://www.django-cms.org/en/blog/2020/07/22/django-cms-security-updates-1/","https://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability/","https://github.com/advisories/GHSA-hx7c-qpfq-xcrp"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-7","url":"https://osv.dev/vulnerability/PYSEC-2022-7"}],"summary":"Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allo"}