CVE-2017-7233
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2017-7233
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7233.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-7233
- Aliases
- Related
- Published
- 2017-04-04T17:59:00Z
- Modified
- 2024-09-18T02:19:19.805373Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely
django.utils.http.is_safe_url()) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies onis_safe_url()to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. - References
-
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/97406
- https://access.redhat.com/errata/RHSA-2017:1445
- https://access.redhat.com/errata/RHSA-2017:1451
- https://access.redhat.com/errata/RHSA-2017:1462
- https://access.redhat.com/errata/RHSA-2017:1470
- https://access.redhat.com/errata/RHSA-2017:1596
- https://access.redhat.com/errata/RHSA-2017:3093
- https://access.redhat.com/errata/RHSA-2018:2927
- https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
- http://www.securitytracker.com/id/1038177
- https://security.alpinelinux.org/vuln/CVE-2017-7233
- https://security-tracker.debian.org/tracker/CVE-2017-7233
Affected packages
Alpine:v3.10 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.11 / py3-django
Package
- Name
- py3-django
- Purl
- pkg:apk/alpine/py3-django?arch=source
Alpine:v3.12 / py3-django
Package
- Name
- py3-django
- Purl
- pkg:apk/alpine/py3-django?arch=source
Alpine:v3.2 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.3 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.4 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.5 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.6 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.7 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.8 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.9 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Debian:11 / python-django
Package
- Name
- python-django
- Purl
- pkg:deb/debian/python-django?arch=source
Debian:12 / python-django
Package
- Name
- python-django
- Purl
- pkg:deb/debian/python-django?arch=source
Debian:13 / python-django
Package
- Name
- python-django
- Purl
- pkg:deb/debian/python-django?arch=source
Git / github.com/django/django
Affected ranges
- Type
- GIT
- Repo
- https://github.com/django/django
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affected
Affected versions
1.*
1.0
1.1
1.10
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10a1
1.10b1
1.10rc1
1.2
1.2.1
1.3
1.4
1.7a1
1.7a2
1.8
1.8.1
1.8.10
1.8.11
1.8.12
1.8.13
1.8.14
1.8.15
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.8a1
1.8b1
1.8b2
1.8c1
1.9
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9a1
1.9b1
1.9rc1
1.9rc2