PT-2017-3841 · Django+1 · Django+1
Charles Bideau
·
Published
2017-09-05
·
Updated
2026-01-03
·
CVE-2017-12794
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Django versions 1.10.x through 1.10.7
Django versions 1.11.x through 1.11.4
Description
The issue is related to the disabling of HTML autoescaping in a portion of the template for the technical 500 debug page in Django. This could allow a cross-site scripting attack under the right circumstances. The vulnerability is unlikely to affect most production sites, as they should not be run with
DEBUG = True, which makes the debug page accessible.Recommendations
For Django versions 1.10.x through 1.10.7, update to version 1.10.8 or later.
For Django versions 1.11.x through 1.11.4, update to version 1.11.5 or later.
As a temporary workaround, consider setting
DEBUG = False in production settings to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Django
Ubuntu