Cross site scripting

2015-01-1616:59:00

PRIOn knowledge base

www.prio-n.com

5.9 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

80.4%

JSON

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a “\njavascript:” URL.

CPENameOperatorVersion
ubuntu_linuxeq12.4 lts
ubuntu_linuxeq14.10
ubuntu_linuxeq14.04
ubuntu_linuxeq10.4 lts
djangole1.4.17
djangoeq1.6.7
djangoeq1.6.5
djangoeq1.6.8
djangoeq1.6.6
djangoeq1.7.2

Name	Operator	Version
ubuntu_linux	eq	12.4 lts
ubuntu_linux	eq	14.10
ubuntu_linux	eq	14.04
ubuntu_linux	eq	10.4 lts
django	le	1.4.17
django	eq	1.6.7
django	eq	1.6.5
django	eq	1.6.8
django	eq	1.6.6
django	eq	1.7.2