Fluid Attacks Database

Description

Django cross-site scripting (XSS) attack via user-supplied redirect URLs The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	django	>=0 <1.4.20 \|\| >=1.5 <1.6.11 \|\| >=1.7 <1.7.7 \|\| >=1.8a1 <1.8c1	1.4.20, 1.6.11, 1.7.7, 1.8c1
debian 13	python-django	>=0 <1.7.7-1	1.7.7-1
debian 11	python-django	>=0 <1.7.7-1	1.7.7-1
debian 14	python-django	>=0 <1.7.7-1	1.7.7-1
debian 12	python-django	>=0 <1.7.7-1	1.7.7-1

Aliases

1. CVE-2015-23172. NVD-2015-23173. OSV-2015-23174. OSV-DEBIAN-2015-23175. GCVE-2015-23176. SECURITY-TRACKER-CVE-2015-2317

References

1. https://github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b2. https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f13. https://github.com/django/django/commit/5510f070711540aaa8d3707776cd77494e688ef94. https://github.com/django/django/commit/770427c2896a078925abfca2317486b284d22f045. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-9.yaml6. https://web.archive.org/web/20200228131706/http://www.securityfocus.com/bid/733197. https://www.djangoproject.com/weblog/2015/mar/18/security-releases8. http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html9. http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html10. http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html11. http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html12. http://ubuntu.com/usn/usn-2539-113. http://www.debian.org/security/2015/dsa-320414. http://www.mandriva.com/security/advisories?name=MDVSA-2015:19515. http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.