Lucene search

K

GoogleOSV:GHSA-78VX-GGCH-WGHM

HistoryMay 17, 2022 - 5:12 a.m.

Django Allows Redirect via Data URL

2022-05-1705:12:01

Google

osv.dev

10

django

http

redirect

validation

security

issue

data url

cross-site scripting

xss

EPSS

0.004

Percentile

72.2%

The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.

References

www.debian.org/security/2012/dsa-2529

www.openwall.com/lists/oss-security/2012/07/31/1

www.openwall.com/lists/oss-security/2012/07/31/2

www.ubuntu.com/usn/USN-1560-1

github.com/django/django

github.com/django/django/commit/4dea4883e6c50d75f215a6b9bcbd95273f57c72d

github.com/django/django/commit/e34685034b60be1112160e76091e5aee60149fa1

nvd.nist.gov/vuln/detail/CVE-2012-3442

www.djangoproject.com/weblog/2012/jul/30/security-releases-issued

EPSS

0.004

Percentile

72.2%

Related for OSV:GHSA-78VX-GGCH-WGHM

gitlab1 cve1 debiancve1 nvd1 prion1 github1 osv2 ubuntucve1 cvelist1 openvas20 nessus7 freebsd1 fedora6 seebug1 ubuntu1 debian1 securityvulns2