Skip to content

Commit 608ab79

Browse files
author
github-actions
committed
Analysis
1 parent 286e378 commit 608ab79

1 file changed

Lines changed: 161 additions & 14 deletions

File tree

‎vulns/mezzanine/PYSEC-0000-CVE-2025-6050.yaml‎

Lines changed: 161 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,167 @@
1-
id: PYSEC-0000-CVE-2025-6050
2-
published: "2025-06-17T11:15:22.400Z"
3-
modified: "2026-06-17T10:01:03.470Z"
4-
aliases:
5-
- CVE-2025-6050
6-
details: Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.
71
affected:
8-
- package:
9-
name: mezzanine
2+
- ecosystem_specific: {}
3+
package:
104
ecosystem: PyPI
5+
name: mezzanine
116
purl: pkg:pypi/mezzanine
127
ranges:
13-
- type: ECOSYSTEM
14-
events:
15-
- introduced: "0"
8+
- events:
9+
- introduced: '0'
1610
- fixed: 6.1.1
17-
ecosystem_specific: {}
11+
type: ECOSYSTEM
12+
versions:
13+
- '0.1'
14+
- 0.1.1
15+
- 0.1.2
16+
- 0.1.3
17+
- 0.1.4
18+
- '0.10'
19+
- 0.10.1
20+
- 0.10.2
21+
- 0.10.3
22+
- 0.10.4
23+
- 0.10.5
24+
- 0.10.6
25+
- '0.11'
26+
- 0.11.1
27+
- 0.11.10
28+
- 0.11.2
29+
- 0.11.3
30+
- 0.11.4
31+
- 0.11.5
32+
- 0.11.6
33+
- 0.11.7
34+
- 0.11.8
35+
- 0.11.9
36+
- '0.12'
37+
- 0.12.1
38+
- 0.12.2
39+
- 0.12.3
40+
- 0.12.4
41+
- 0.12.5
42+
- '0.2'
43+
- 0.2.1
44+
- 0.2.2
45+
- 0.2.3
46+
- 0.2.4
47+
- 0.3.0
48+
- 0.3.1
49+
- 0.3.2
50+
- 0.3.3
51+
- 0.3.4
52+
- 0.3.5
53+
- '0.4'
54+
- 0.5.1
55+
- 0.5.2
56+
- 0.5.3
57+
- 0.5.4
58+
- '0.6'
59+
- 0.6.1
60+
- 0.6.2
61+
- 0.6.3
62+
- 0.6.4
63+
- '0.7'
64+
- 0.7.2
65+
- '0.8'
66+
- 0.8.1
67+
- 0.8.2
68+
- 0.8.3
69+
- 0.8.4
70+
- 0.8.5
71+
- '0.9'
72+
- 0.9.1
73+
- 1.0.0
74+
- 1.0.1
75+
- 1.0.10
76+
- 1.0.2
77+
- 1.0.3
78+
- 1.0.4
79+
- 1.0.5
80+
- 1.0.6
81+
- 1.0.7
82+
- 1.0.8
83+
- 1.0.9
84+
- 1.1.0
85+
- 1.1.1
86+
- 1.1.2
87+
- 1.1.3
88+
- 1.1.4
89+
- 1.2.0
90+
- 1.2.1
91+
- 1.2.2
92+
- 1.2.3
93+
- 1.2.4
94+
- 1.3.0
95+
- 1.4.0
96+
- 1.4.1
97+
- 1.4.10
98+
- 1.4.11
99+
- 1.4.12
100+
- 1.4.13
101+
- 1.4.14
102+
- 1.4.15
103+
- 1.4.16
104+
- 1.4.2
105+
- 1.4.3
106+
- 1.4.4
107+
- 1.4.5
108+
- 1.4.6
109+
- 1.4.7
110+
- 1.4.8
111+
- 1.4.9
112+
- 3.0.0
113+
- 3.0.1
114+
- 3.0.2
115+
- 3.0.3
116+
- 3.0.4
117+
- 3.0.5
118+
- 3.0.6
119+
- 3.0.7
120+
- 3.0.8
121+
- 3.0.9
122+
- 3.1.0
123+
- 3.1.1
124+
- 3.1.10
125+
- 3.1.2
126+
- 3.1.3
127+
- 3.1.4
128+
- 3.1.5
129+
- 3.1.6
130+
- 3.1.7
131+
- 3.1.8
132+
- 3.1.9
133+
- 4.0.0
134+
- 4.0.1
135+
- 4.1.0
136+
- 4.2.0
137+
- 4.2.1
138+
- 4.2.2
139+
- 4.2.3
140+
- 4.3.0
141+
- 4.3.1
142+
- 5.0.0
143+
- 5.0.0a1
144+
- 5.0.0rc1
145+
- 5.1.0
146+
- 5.1.1
147+
- 5.1.2
148+
- 5.1.3
149+
- 5.1.4
150+
- 6.0.0
151+
- 6.0.1
152+
- 6.1.0
153+
aliases:
154+
- CVE-2025-6050
155+
details: Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting
156+
(XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js"
157+
function, which fails to properly sanitize blog post titles before including them
158+
in JSON responses served via "/admin/displayable_links.js". An authenticated admin
159+
user can create a blog post with a malicious JavaScript payload in the title field,
160+
then trick another admin user into clicking a direct link to the "/admin/displayable_links.js"
161+
endpoint, causing the malicious script to execute in their browser.
162+
id: PYSEC-0000-CVE-2025-6050
163+
modified: '2026-06-23T21:50:40.134294Z'
164+
published: '2025-06-17T11:15:22.400Z'
18165
references:
19166
- type: REPORT
20167
url: https://github.com/stephenmcd/mezzanine/discussions/2080
@@ -23,5 +170,5 @@ references:
23170
- type: EVIDENCE
24171
url: https://advisory.checkmarx.net/advisory/CVE-2025-6050/
25172
severity:
26-
- type: CVSS_V3
27-
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
173+
- score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
174+
type: CVSS_V3

0 commit comments

Comments
 (0)