PT-2015-5710 · Django Software Foundation+1 · Django+1

Daniel Chatfield · Published 2015-03-19 · Updated 2022-05-14 · CVE-2015-2317

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.4.20 Django versions 1.5.x Django versions 1.6.x prior to 1.6.11 Django versions 1.7.x prior to 1.7.7 Django versions 1.8.x prior to 1.8c1

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL. This is demonstrated by a URL containing a control character, such as x08javascript:. The utils.http.is safe url function does not properly validate URLs, leading to this security issue.

Recommendations For Django versions prior to 1.4.20, update to version 1.4.20 or later. For Django versions 1.5.x, update to a version with the fix, as 1.5.x is affected but no specific end version is provided. For Django versions 1.6.x prior to 1.6.11, update to version 1.6.11 or later. For Django versions 1.7.x prior to 1.7.7, update to version 1.7.7 or later. For Django versions 1.8.x prior to 1.8c1, update to version 1.8c1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-2317

DLA-272-1

DSA-3204-1

GHSA-7FQ8-4PV5-5W5C

MGASA-2015-0127

PYSEC-2015-9

SUSE-SU-2015:0563-1

SUSE-SU-2015:0694-1

SUSE-SU-2015:0695-1

SUSE-SU-2015:1109-1

SUSE-SU-2015:1112-1

USN-2539-1

Affected Products

Django

Ubuntu

References · 48

• http://ubuntu.com/usn/usn-2539-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2317 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-2317 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2317 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-2317 · Security Note
• https://ubuntu.com/security/CVE-2015-2316 · Vendor Advisory
• http://debian.org/security/2015/dsa-3204 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html · Vendor Advisory
• https://djangoproject.com/weblog/2015/mar/18/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-2317 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1109-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2539-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html · Vendor Advisory