PT-2015-5710 · Django Software Foundation+1 · Django+1

Daniel Chatfield · Publicado 2015-03-19 · Atualizado 2022-05-14 · CVE-2015-2317

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.4.20 Django versions 1.5.x Django versions 1.6.x prior to 1.6.11 Django versions 1.7.x prior to 1.7.7 Django versions 1.8.x prior to 1.8c1

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL. This is demonstrated by a URL containing a control character, such as x08javascript:. The utils.http.is safe url function does not properly validate URLs, leading to this security issue.

Recommendations For Django versions prior to 1.4.20, update to version 1.4.20 or later. For Django versions 1.5.x, update to a version with the fix, as 1.5.x is affected but no specific end version is provided. For Django versions 1.6.x prior to 1.6.11, update to version 1.6.11 or later. For Django versions 1.7.x prior to 1.7.7, update to version 1.7.7 or later. For Django versions 1.8.x prior to 1.8c1, update to version 1.8c1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-2317

DLA-272-1

DSA-3204-1

GHSA-7FQ8-4PV5-5W5C

MGASA-2015-0127

PYSEC-2015-9

SUSE-SU-2015:0563-1

SUSE-SU-2015:0694-1

SUSE-SU-2015:0695-1

SUSE-SU-2015:1109-1

SUSE-SU-2015:1112-1

USN-2539-1

Produtos afetados

Django

Ubuntu

Referências · 48

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/5510f070711540aaa8d3707776cd77494e688ef9 · Nota
• https://github.com/django/django/commit/770427c2896a078925abfca2317486b284d22f04 · Nota
• https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1 · Nota
• https://github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-9.yaml · Nota
• http://ubuntu.com/usn/usn-2539-1 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2015:195 · Aviso do Fabricante
• https://bugzilla.suse.com/913056 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=15528 · Nota
• http://securityfocus.com/bid/73319 · Nota
• https://suse.com/security/cve/CVE-2015-2317 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2317 · Nota de Segurança
• https://djangoproject.com/weblog/2015/mar/09/security-releases · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-2317 · Aviso do Fabricante