CVE-2021-44649

Name of the Vulnerable Software and Affected Versions Django CMS version 3.7.3

Description The issue arises from the lack of validation of the plugin type parameter when generating error messages for an invalid plugin type, leading to a Cross Site Scripting (XSS) issue. This allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.

Recommendations For Django CMS version 3.7.3, as a temporary workaround, consider restricting the use of the plugin type parameter until a patch is available. Avoid using the plugin type parameter in error messages for invalid plugin types to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.