DEBIAN-CVE-2017-7233
Record from OSV · Published April 4, 2017
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| python-django | Debian:14 | 1:1.10.7-1 |
| python-django | Debian:12 | 1:1.10.7-1 |
| python-django | Debian:13 | 1:1.10.7-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | python-django | 0 |
| Debian:12 | python-django | 0 |
| Debian:13 | python-django | 0 |
Timeline
- Apr 4, 2017 CVE Published
- Sep 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2017-7233
vulnetix vdb fixes DEBIAN-CVE-2017-7233Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2017-7233/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart