CVE-2015-0220 — Cross-site Scripting in Django
Severity
4.3MEDIUMNVD
OSV5.0
EPSS
2.5%
top 14.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 16
Latest updateMay 17
Description
The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.
CVSS vector
AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9
Affected Packages2 packages
Also affects: Ubuntu Linux 10.04, 12.04, 14.04, 14.10
🔴Vulnerability Details
5📋Vendor Advisories
3💬Community
5Bugzilla▶
CVE-2015-0220 python-django14: Django: Mitigated possible XSS attack via user-supplied redirect URLs [fedora-20]↗2015-01-14
Bugzilla▶
CVE-2015-0220 python-django: Django: Mitigated possible XSS attack via user-supplied redirect URLs [epel-7]↗2015-01-14
Bugzilla▶
CVE-2015-0220 python-django: Django: Mitigated possible XSS attack via user-supplied redirect URLs [fedora-all]↗2015-01-14
Bugzilla▶
CVE-2015-0220 Django14: Django: Mitigated possible XSS attack via user-supplied redirect URLs [epel-6]↗2015-01-14
Bugzilla
▶