logo

Database

Server side cross-site scripting In django

Description

Django vulnerable to XSS on 500 pages In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 12

10

Aliases

1. CVE-2017-127942. NVD-2017-127943. OSV-2017-127944. OSV-ALPINE-2017-127945. OSV-DEBIAN-2017-127946. GHSA-9r8w-6x8c-6jr97. GCVE-2017-127948. SECURITY-CVE-2017-127949. SECURITY-TRACKER-CVE-2017-12794

References

1. https://github.com/django/django/commit/58e08e80e362db79eb0fd775dc81faad90dca47a2. https://github.com/django/django/commit/e35a0c56086924f331e9422daa266e907a4784cc3. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-44.yaml4. https://usn.ubuntu.com/3559-15. https://web.archive.org/web/20170927072701/http://www.securitytracker.com/id/10392646. https://web.archive.org/web/20200227150819/http://www.securityfocus.com/bid/1006437. https://www.djangoproject.com/weblog/2017/sep/05/security-releases8. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12794.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.