vulnwire
7.4high

CVE-2016-2512

Django XSS Vulnerability

Also known as GHSA-pw27-w7w4-9qc7, PYSEC-2016-15

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.1%
percentile 91%
Public exploits
0
none known

The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.

Exploit prediction (EPSS)

4.05% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub3.07.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Affected packages

EcosystemPackageAffectedFixed in
pypidjango
<1.8.10
>=1.9a1, <1.9.3
>=1.9, <1.9.3
1.8.10
1.9.3

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
Technology feeds
Django (RSS, critical only)

References

  • rhn.redhat.com /errata/RHSA-2016-0506.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securitytracker.com /id/1035152 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/83879 · vdb-entry, x_refsource_BID, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-0504.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2016/dsa-3544 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-0502.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • ubuntu.com /usn/USN-2915-3 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • oracle.com /technetwork/topics/security/bulletinapr2016-2952098.html · x_refsource_CONFIRM, x_transferred
  • ubuntu.com /usn/USN-2915-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-0505.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • ubuntu.com /usn/USN-2915-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • djangoproject.com /weblog/2016/mar/01/security-releases/ · x_refsource_CONFIRM, x_transferred
  • github.com /django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-2512 · advisory
  • github.com /django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350 · web
  • github.com /django/django/commit/fc6d147a63f89795dbcdecb0559256470fff4380 · web
  • github.com /django/django · package
  • github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-15.yaml · web
  • web.archive.org /web/20210123090815/http://www.securityfocus.com/bid/83879 · web
  • web.archive.org /web/20210413200202/http://www.securitytracker.com/id/1035152 · web
  • djangoproject.com /weblog/2016/mar/01/security-releases · web
  • github.com /advisories/GHSA-pw27-w7w4-9qc7 · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.