LiveActive security incident?Get immediate response
CVE Record

CVE-2020-25626: A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2.

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Django REST Framework had an XSS flaw in its browsable API viewer. If an attacker could control specific displayed strings, malicious script could execute in another user's browser when that viewer rendered the content. Exposure is mainly relevant where the browsable API is enabled and reachable.

Executive priority

Treat this as a targeted remediation item, not an emergency based on provided evidence. Prioritize internet-facing or staff-facing APIs where the browsable API is enabled and sensitive sessions may be exposed to injected script.

Technical view

Versions before Django REST Framework 3.12.0 and before 3.11.2 did not properly escape certain user-influenced strings in the browsable API viewer. The source classifies this as CWE-20 and describes script tag injection leading to cross-site scripting. No CVSS score is provided.

Likely exposure

Applications using vulnerable Django REST Framework versions with the browsable API enabled, especially if authenticated staff or users can view attacker-controlled API content through that interface.

Exploitation context

The source bundle does not report known active exploitation, and CISA KEV status is false. Exploitation requires control over affected displayed strings and a victim viewing them in the browsable API.

Researcher notes

The provided evidence identifies the affected component and fixed upstream version thresholds, but does not include CVSS details, exploit maturity, or precise escaping locations. Validate exposure by configuration and dependency version rather than assuming all DRF APIs are exploitable.

Mitigation direction

  • Upgrade Django REST Framework to 3.12.0, 3.11.2, or a later supported release.
  • Review Debian or vendor package advisories for fixed downstream package versions.
  • Restrict or disable the browsable API in production if it is not operationally required.
  • Check NetApp guidance if affected products bundle or depend on vulnerable components.

Validation and detection

  • Inventory deployed Django REST Framework versions across applications and containers.
  • Confirm whether the browsable API is enabled and externally reachable.
  • Review application paths that render user-controlled strings in the browsable API.
  • Verify package upgrades through dependency lockfiles and runtime version checks.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-25626 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aDjango REST FrameworkAll django-rest-framework versions before 3.12.0 and before 3.11.2Listed
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-20 · source CWE mapping

Improper Input Validation

Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs