CVE-2017-12794

Source
https://nvd.nist.gov/vuln/detail/CVE-2017-12794
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12794.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-12794
Aliases
Downstream
Related
Published
2017-09-07T13:29:00Z
Modified
2025-09-30T06:57:56.077506Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.

References

Affected packages

Git / github.com/django/django

Affected versions

1.*

1.0
1.1
1.10
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10a1
1.10b1
1.10rc1
1.11
1.11.1
1.11.2
1.11.3
1.11.4
1.11a1
1.11b1
1.11rc1
1.2
1.2.1
1.3
1.4
1.7a1
1.7a2