CVE-2013-6044

2013-09-2400:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.008

Percentile

81.2%

JSON

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6,
1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL’s scheme as safe
even if it is not HTTP or HTTPS, which might introduce cross-site scripting
(XSS) or other vulnerabilities into Django applications that use this
function, as demonstrated by “the login view in django.contrib.auth.views”
and the javascript: scheme.

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchpython-django< 1.1.1-2ubuntu1.9UNKNOWN
ubuntu12.04noarchpython-django< 1.3.1-4ubuntu1.8UNKNOWN
ubuntu12.10noarchpython-django< 1.4.1-2ubuntu0.4UNKNOWN
ubuntu13.04noarchpython-django< 1.4.5-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	python-django	< 1.1.1-2ubuntu1.9	UNKNOWN
ubuntu	12.04	noarch	python-django	< 1.3.1-4ubuntu1.8	UNKNOWN
ubuntu	12.10	noarch	python-django	< 1.4.1-2ubuntu0.4	UNKNOWN
ubuntu	13.04	noarch	python-django	< 1.4.5-1ubuntu0.1	UNKNOWN