Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.debian.org/security/2017/dsa-3835 - | |
| References | () http://www.securityfocus.com/bid/97406 - Third Party Advisory, VDB Entry | |
| References | () http://www.securitytracker.com/id/1038177 - | |
| References | () https://access.redhat.com/errata/RHSA-2017:1445 - | |
| References | () https://access.redhat.com/errata/RHSA-2017:1451 - | |
| References | () https://access.redhat.com/errata/RHSA-2017:1462 - | |
| References | () https://access.redhat.com/errata/RHSA-2017:1470 - | |
| References | () https://access.redhat.com/errata/RHSA-2017:1596 - | |
| References | () https://access.redhat.com/errata/RHSA-2017:3093 - | |
| References | () https://access.redhat.com/errata/RHSA-2018:2927 - | |
| References | () https://www.djangoproject.com/weblog/2017/apr/04/security-releases/ - Vendor Advisory |
Information
Published : 2017-04-04 17:59
Updated : 2024-11-21 03:31
NVD link : CVE-2017-7233
Mitre link : CVE-2017-7233
CVE.ORG link : CVE-2017-7233
JSON object : View
Products Affected
djangoproject
- django
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')