PT-2011-2567 · Django · Django

Published 2011-02-14 · Updated 2018-07-23 · CVE-2011-0697

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.1.x through 1.1.3 Django versions 1.2.x through 1.2.4

Description A cross-site scripting (XSS) issue might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.

Recommendations For Django versions 1.1.x through 1.1.3, update to version 1.1.4 or later. For Django versions 1.2.x through 1.2.4, update to version 1.2.5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-0697

DSA-2163-1

GHSA-8M3R-RV5G-FCPQ

PYSEC-2011-11

PYSEC-2011-31

Affected Products

Django

References · 38

• http://debian.org/security/2011/dsa-2163 · Vendor Advisory
• http://djangoproject.com/weblog/2011/feb/08/security · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054207.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054208.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0697 · Security Note
• https://osv.dev/vulnerability/CVE-2011-0697 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/02/09/6 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=676359 · Patch
• https://osv.dev/vulnerability/PYSEC-2011-31 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0697 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:031 · Vendor Advisory
• http://ubuntu.com/usn/USN-1066-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2011-11 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-0697 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8m3r-rv5g-fcpq · Vendor Advisory