views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2023-10-22T00:00:00
Updated: 2023-10-22T18:55:18.177241
Reserved: 2023-10-22T00:00:00
Link: CVE-2021-46898
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-10-22T19:15:08.297
Modified: 2023-10-30T15:56:43.517
Link: CVE-2021-46898
JSON object: View
Redhat Information
No data.
CWE