mezzanine xss

[deFming]

Version: <=4.3.1
My English is not good, the report is translated by Google.
Recurring vulnerabilities:
Vulnerability url: http://127.0.0.1:8000/admin/blog/blogpost/add/
When adding a blog, use Burpsuite to capture the package, modify the title to test<svg/onload=alert(1)> and the content as <svg>

Return http://127.0.0.1:8000/blog/ to trigger the xss

The cause of the vulnerability is due to the description_from_content function of core/models.py, line 184, where the value of title is called, resulting in xss

[kenbolton]

Is this what you are describing? https://nvd.nist.gov/vuln/detail/CVE-2018-16632

Resolved by stephenmcd/grappelli-safe@cb1d459

[deFming]

Is this what you are describing? https://nvd.nist.gov/vuln/detail/CVE-2018-16632

Resolved by stephenmcd/grappelli-safe@cb1d459

No, not the same, the trigger point of this xss is in the 112 line
https://github.com/stephenmcd/mezzanine/blob/master/mezzanine/blog/templates/blog/blog_post_list.html line112