Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2013-6044
HistoryOct 04, 2013 - 5:55 p.m.

CVE-2013-6044

2013-10-0417:55:10
CWE-79
mitre
web.nvd.nist.gov
40
cve
2013
6044
django
is_safe_url
xss
security vulnerability
nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.6

Confidence

High

EPSS

0.008

Percentile

81.2%

JSON

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL’s scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by “the login view in django.contrib.auth.views” and the javascript: scheme.

Affected configurations

Nvd
Node
djangoprojectdjangoMatch1.4
OR
djangoprojectdjangoMatch1.4.1
OR
djangoprojectdjangoMatch1.4.2
OR
djangoprojectdjangoMatch1.4.4
OR
djangoprojectdjangoMatch1.4.5
OR
djangoprojectdjangoMatch1.5
OR
djangoprojectdjangoMatch1.5.1
OR
djangoprojectdjangoMatch1.6beta1
VendorProductVersionCPE
djangoprojectdjango1.4cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:*
djangoprojectdjango1.4.1cpe:2.3:a:djangoproject:django:1.4.1:*:*:*:*:*:*:*
djangoprojectdjango1.4.2cpe:2.3:a:djangoproject:django:1.4.2:*:*:*:*:*:*:*
djangoprojectdjango1.4.4cpe:2.3:a:djangoproject:django:1.4.4:*:*:*:*:*:*:*
djangoprojectdjango1.4.5cpe:2.3:a:djangoproject:django:1.4.5:*:*:*:*:*:*:*
djangoprojectdjango1.5cpe:2.3:a:djangoproject:django:1.5:*:*:*:*:*:*:*
djangoprojectdjango1.5.1cpe:2.3:a:djangoproject:django:1.5.1:*:*:*:*:*:*:*
djangoprojectdjango1.6cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:*

Related

osv 3
openvas 2
nessus 1
cvelist 1
nvd 1
debiancve 1
gitlab 1
prion 1
ubuntucve 1
github 1
redhat 1
osv
osv
PYSEC-2013-21
2013-10-04 17:55:00
python-django - cross-site scripting vulnerability
2013-08-23 00:00:00
Django Cross-site scripting (XSS) vulnerability via is_safe_url function
2022-05-17 00:23:23
openvas
openvas
Debian Security Advisory DSA 2740-2 (python-django - cross-site scripting vulnerability)
2013-08-23 00:00:00
Debian: Security Advisory (DSA-2740-1)
2013-08-22 00:00:00
nessus
nessus
Debian DSA-2740-2 : python-django - XSS vulnerability
2013-08-25 00:00:00
cvelist
cvelist
CVE-2013-6044
2013-10-04 17:00:00
nvd
nvd
CVE-2013-6044
2013-10-04 17:55:10
debiancve
debiancve
CVE-2013-6044
2013-10-04 17:55:10
gitlab
gitlab
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
2022-05-17 00:00:00
prion
prion
Cross site scripting
2013-10-04 17:55:00
ubuntucve
ubuntucve
CVE-2013-6044
2013-09-24 00:00:00
github
github
Django Cross-site scripting (XSS) vulnerability via is_safe_url function
2022-05-17 00:23:23
redhat
redhat
(RHSA-2013:1521) Moderate: python-django security update
2013-11-14 00:00:00

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.6

Confidence

High

EPSS

0.008

Percentile

81.2%

JSON
Related for CVE-2013-6044
osv3openvas2nessus1cvelist1nvd1debiancve1gitlab1prion1ubuntucve1github1redhat1