VDB
ALPINE-CVE-2017-7233
ALPINE-CVE-2017-7233
PUBLISHED
CVSS 6.099999904632568 MEDIUM
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
Risk Scores
CVSS 3.0
6.099999904632568
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.10 | py-django | 0, 0, 1.10.5-r0 |
| Alpine:v3.11 | py3-django | 1.4.1-r0, 1.6.6-r0, 1.7-r0 |
| Alpine:v3.6 | py-django | 1.8.8-r0, 1.8.4-r0, 1.8.3-r0 |
| Alpine:v3.4 | py-django | 1.8.15-r0, 1.8.3-r0, 1.8.4-r0 |
| Alpine:v3.3 | py-django | 1.5.6-r0, 1.5.5-r0, 1.5.1-r0 |
| Alpine:v3.5 | py-django | 1.2.5-r1, 0, 1.2.5-r0 |
| Alpine:v3.12 | py3-django | 1.2.5-r0, 1.10.5-r0, 1.5-r0 |
| Alpine:v3.2 | py-django | 1.2.5-r0, 0, 1.8.3-r1 |
| Alpine:v3.7 | py-django | 0, 0, 1.8.8-r0 |
| Alpine:v3.8 | py-django | 1.8.16-r0, 1.8.6-r0, 1.8.8-r0 |
| Alpine:v3.9 | py-django | 0, 1.10.5-r0, 1.2.5-r1 |
Timeline
- Apr 4, 2017 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated