PT-2013-5937 · Django · Django

Nick Bruun · Published 2013-10-04 · Updated 2022-05-17 · CVE-2013-6044

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.5 Django versions 1.5.x through 1.5.1 Django versions 1.6 before beta 2

Description The issue in the is safe url function in utils/http.py might introduce cross-site scripting (XSS) or other issues into applications that use this function. This is demonstrated by the login view in django.contrib.auth.views and the javascript: scheme.

Recommendations For Django versions 1.4.x through 1.4.5, update to version 1.4.6 or later. For Django versions 1.5.x through 1.5.1, update to version 1.5.2 or later. For Django versions 1.6 before beta 2, update to beta 2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-6044

DSA-2740-1

GHSA-9CWG-MHXF-HH59

PYSEC-2013-21

RHSA-2013:1521

Affected Products

Django

References · 21

• http://debian.org/security/2013/dsa-2740 · Vendor Advisory
• http://secunia.com/advisories/54476 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1521.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-21 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6044 · Security Note
• https://djangoproject.com/weblog/2013/aug/13/security-releases-issued · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6044 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-6044 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-6044 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9cwg-mhxf-hh59 · Vendor Advisory
• https://github.com/django/django · Note
• https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f · Note
• https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a · Note
• https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762 · Note