Lucene search

RedhatCVE-2012-3442

HistoryJul 31, 2012 - 5:55 p.m.

CVE-2012-3442

2012-07-3117:55:01

CWE-79

redhat

web.nvd.nist.gov

cve

2012

3442

django

xss

attacks

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.004

Percentile

72.2%

JSON

The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.

Affected configurations

Nvd

Node

djangoprojectdjangoRange≤1.3

djangoprojectdjangoMatch0.95

djangoprojectdjangoMatch0.96

djangoprojectdjangoMatch1.0

djangoprojectdjangoMatch1.0alpha1

djangoprojectdjangoMatch1.0alpha2

djangoprojectdjangoMatch1.0beta

djangoprojectdjangoMatch1.0beta2

djangoprojectdjangoMatch1.0.1

djangoprojectdjangoMatch1.0.2

djangoprojectdjangoMatch1.1

djangoprojectdjangoMatch1.1alpha1

djangoprojectdjangoMatch1.1beta1

djangoprojectdjangoMatch1.1rc1

djangoprojectdjangoMatch1.1.2

djangoprojectdjangoMatch1.1.3

djangoprojectdjangoMatch1.1.4

djangoprojectdjangoMatch1.2

djangoprojectdjangoMatch1.2beta1

djangoprojectdjangoMatch1.2rc1

djangoprojectdjangoMatch1.2-alpha1

djangoprojectdjangoMatch1.2.2

djangoprojectdjangoMatch1.2.4

djangoprojectdjangoMatch1.2.5

djangoprojectdjangoMatch1.2.6

djangoprojectdjangoMatch1.2.7

djangoprojectdjangoMatch1.3alpha1

djangoprojectdjangoMatch1.3beta1

djangoprojectdjangoMatch1.4

VendorProductVersionCPE
djangoprojectdjango1.0cpe:/a:djangoproject:django:1.0:::
djangoprojectdjango1.0cpe:/a:djangoproject:django:1.0:alpha2::
djangoprojectdjango1.2.4cpe:/a:djangoproject:django:1.2.4:::
djangoprojectdjango1.2cpe:/a:djangoproject:django:1.2:beta1::
djangoprojectdjango1.0.1cpe:/a:djangoproject:django:1.0.1:::
djangoprojectdjango1.4cpe:/a:djangoproject:django:1.4:::
djangoprojectdjango1.2cpe:/a:djangoproject:django:1.2:rc1::
djangoprojectdjango1.1cpe:/a:djangoproject:django:1.1:alpha1::
djangoprojectdjangocpe:/a:djangoproject:django::::
djangoprojectdjango1.0cpe:/a:djangoproject:django:1.0:beta::

Vendor	Product	Version	CPE
djangoproject	django	1.0	cpe:/a:djangoproject:django:1.0:::
djangoproject	django	1.0	cpe:/a:djangoproject:django:1.0:alpha2::
djangoproject	django	1.2.4	cpe:/a:djangoproject:django:1.2.4:::
djangoproject	django	1.2	cpe:/a:djangoproject:django:1.2:beta1::
djangoproject	django	1.0.1	cpe:/a:djangoproject:django:1.0.1:::
djangoproject	django	1.4	cpe:/a:djangoproject:django:1.4:::
djangoproject	django	1.2	cpe:/a:djangoproject:django:1.2:rc1::
djangoproject	django	1.1	cpe:/a:djangoproject:django:1.1:alpha1::
djangoproject	django		cpe:/a:djangoproject:django::::
djangoproject	django	1.0	cpe:/a:djangoproject:django:1.0:beta::