Stored XSS in django CMS Attributes Fields
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS. This issue affects django CMS Attributes Fields: before 4.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00493 42nd percentileScored 2026-11-07
Fix Fixed django CMS Attributes Fields (django CMS Association): 4.0djangocms-attributes-field (PyPI): 4.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| django CMS Association | django CMS Attributes Fields | before 4.0 | 4.0 | Patch available | CNA |
| — | djangocms-attributes-field (PyPI) | before 4.0.0 | 4.0.0 | Patch available | GHSA-vxcv-4xvf-pc22 |
- django CMS Attributes Fields Vendordjango CMS Association Affected before 4.0 Fixed in 4.0 Patch available CNA
- djangocms-attributes-field (PyPI) Vendor— Affected before 4.0.0 Fixed in 4.0.0 Patch available GHSA-vxcv-4xvf-pc22
Remediation
- Fix · CNA django CMS Attributes Fields (django CMS Association) Fixed in 4.0
- Fix · GHSA-vxcv-4xvf-pc22 djangocms-attributes-field (PyPI) Fixed in 4.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-11406
- 2026-10-03 Alias added: GHSA-vxcv-4xvf-pc22
References
Other 9
- https://www.usom.gov.tr/bildirim/tr-24-1864
- https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field/
- https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability/
- https://github.com/django-cms/djangocms-attributes-field/commit/fe68d29ab78db5885bc31b67cf0537f1f02b33ad
- https://pypi.org/project/djangocms-attributes-field/#history
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1864
- https://github.com/django-cms/djangocms-attributes-field
- https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability
- https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field
More django CMS Association vulnerabilities
- TI-2024-10567 File Upload Bypass in django Filer CVSS 3.1MEDIUM 5.5
Sources
- CVE-2024-11406 · CVE Program
- CVE-2024-11406 · NVD
- FIRST EPSS
- GHSA-vxcv-4xvf-pc22 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences