VDB
PYSEC-2017-9
PYSEC-2017-9
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
Risk Scores
CVSS v4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | django | 1.10.6, 1.10, 1.9 |
Timeline
- Apr 4, 2017 CVE Published
- Nov 8, 2023 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://www.djangoproject.com/weblog/2017/apr/04/security-releases/ article
- http://www.securityfocus.com/bid/97406 url
- http://www.securitytracker.com/id/1038177 url
- https://github.com/advisories/GHSA-37hp-765x-j95x advisory
- http://www.debian.org/security/2017/dsa-3835 advisory
- https://access.redhat.com/errata/RHSA-2017:3093 advisory
- https://access.redhat.com/errata/RHSA-2017:1596 advisory
- https://access.redhat.com/errata/RHSA-2017:1470 advisory
- https://access.redhat.com/errata/RHSA-2017:1462 advisory
- https://access.redhat.com/errata/RHSA-2017:1451 advisory
- https://access.redhat.com/errata/RHSA-2017:1445 advisory
- https://access.redhat.com/errata/RHSA-2018:2927 advisory