~ / search / GHSA-gv98-g628-m9x5

GHSA-gv98-g628-m9x5

Django Cross-site Scripting Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-0220

Packages

EcosystemPackageAffectedFixed in
PyPI Django < 1.4.18 1.4.18
PyPI Django >= 1.6, < 1.6.10 1.6.10
PyPI Django >= 1.7, < 1.7.3 1.7.3

Details

As written in the advisory (Markdown source, shown as plain text).

The `django.util.http.is_safe_url` function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a `\njavascript:` URL.

References

External links from the advisory. They lead to third-party sites.