CVE-2017-7233
python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs
Severity Score
6.1
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
Django 1.10 en versiones anteriores a 1.10.7, 1.9 en versiones anteriores a 1.9.13, y 1.8 en versiones anteriores a 1.8.18 se basa en la entrada del usuario en algunos casos para redirigir al usuario a una URL de "éxito". La comprobación de seguridad de estos redireccionamientos (a saber, `` django.utils.http.is_safe_url()``) considera que algunas URL numéricas son "seguras" cuando no deberían serlo, también conocida como una vulnerabilidad de redirección abierta. Además, si un desarrollador confía en `` is_safe_url() `` para proporcionar destinos de redirección seguros y pone esa URL en un enlace, podría sufrir un ataque XSS.
A redirect flaw, where the is_safe_url() function did not correctly sanitize numeric-URL user input, was found in python-django. A remote attacker could exploit this flaw to perform XSS attacks against the OpenStack dashboard.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-03-22 CVE Reserved
- 2017-04-04 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/97406 | Third Party Advisory | |
| http://www.securitytracker.com/id/1038177 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2017/dsa-3835 | 2018-10-17 | |
| https://access.redhat.com/errata/RHSA-2017:1445 | 2018-10-17 | |
| https://access.redhat.com/errata/RHSA-2017:1451 | 2018-10-17 | |
| https://access.redhat.com/errata/RHSA-2017:1462 | 2018-10-17 | |
| https://access.redhat.com/errata/RHSA-2017:1470 | 2018-10-17 | |
| https://access.redhat.com/errata/RHSA-2017:1596 | 2018-10-17 | |
| https://access.redhat.com/errata/RHSA-2017:3093 | 2018-10-17 | |
| https://access.redhat.com/errata/RHSA-2018:2927 | 2018-10-17 | |
| https://www.djangoproject.com/weblog/2017/apr/04/security-releases | 2018-10-17 | |
| https://access.redhat.com/security/cve/CVE-2017-7233 | 2018-10-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1437234 | 2018-10-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.0 Search vendor "Djangoproject" for product "Django" and version "1.8.0" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.0 Search vendor "Djangoproject" for product "Django" and version "1.8.0" | a1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.0 Search vendor "Djangoproject" for product "Django" and version "1.8.0" | b1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.0 Search vendor "Djangoproject" for product "Django" and version "1.8.0" | b2 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.0 Search vendor "Djangoproject" for product "Django" and version "1.8.0" | c1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.1 Search vendor "Djangoproject" for product "Django" and version "1.8.1" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.2 Search vendor "Djangoproject" for product "Django" and version "1.8.2" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.3 Search vendor "Djangoproject" for product "Django" and version "1.8.3" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.4 Search vendor "Djangoproject" for product "Django" and version "1.8.4" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.5 Search vendor "Djangoproject" for product "Django" and version "1.8.5" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.6 Search vendor "Djangoproject" for product "Django" and version "1.8.6" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.7 Search vendor "Djangoproject" for product "Django" and version "1.8.7" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.8 Search vendor "Djangoproject" for product "Django" and version "1.8.8" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.9 Search vendor "Djangoproject" for product "Django" and version "1.8.9" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.10 Search vendor "Djangoproject" for product "Django" and version "1.8.10" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.11 Search vendor "Djangoproject" for product "Django" and version "1.8.11" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.12 Search vendor "Djangoproject" for product "Django" and version "1.8.12" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.13 Search vendor "Djangoproject" for product "Django" and version "1.8.13" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.14 Search vendor "Djangoproject" for product "Django" and version "1.8.14" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.15 Search vendor "Djangoproject" for product "Django" and version "1.8.15" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.16 Search vendor "Djangoproject" for product "Django" and version "1.8.16" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.8.17 Search vendor "Djangoproject" for product "Django" and version "1.8.17" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9 Search vendor "Djangoproject" for product "Django" and version "1.9" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9 Search vendor "Djangoproject" for product "Django" and version "1.9" | a1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9 Search vendor "Djangoproject" for product "Django" and version "1.9" | b1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9 Search vendor "Djangoproject" for product "Django" and version "1.9" | rc1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9 Search vendor "Djangoproject" for product "Django" and version "1.9" | rc2 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.1 Search vendor "Djangoproject" for product "Django" and version "1.9.1" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.2 Search vendor "Djangoproject" for product "Django" and version "1.9.2" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.3 Search vendor "Djangoproject" for product "Django" and version "1.9.3" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.4 Search vendor "Djangoproject" for product "Django" and version "1.9.4" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.5 Search vendor "Djangoproject" for product "Django" and version "1.9.5" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.6 Search vendor "Djangoproject" for product "Django" and version "1.9.6" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.7 Search vendor "Djangoproject" for product "Django" and version "1.9.7" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.8 Search vendor "Djangoproject" for product "Django" and version "1.9.8" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.9 Search vendor "Djangoproject" for product "Django" and version "1.9.9" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.10 Search vendor "Djangoproject" for product "Django" and version "1.9.10" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.11 Search vendor "Djangoproject" for product "Django" and version "1.9.11" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.9.12 Search vendor "Djangoproject" for product "Django" and version "1.9.12" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.0 Search vendor "Djangoproject" for product "Django" and version "1.10.0" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.0 Search vendor "Djangoproject" for product "Django" and version "1.10.0" | a1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.0 Search vendor "Djangoproject" for product "Django" and version "1.10.0" | b1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.0 Search vendor "Djangoproject" for product "Django" and version "1.10.0" | rc1 |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.1 Search vendor "Djangoproject" for product "Django" and version "1.10.1" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.2 Search vendor "Djangoproject" for product "Django" and version "1.10.2" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.3 Search vendor "Djangoproject" for product "Django" and version "1.10.3" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.4 Search vendor "Djangoproject" for product "Django" and version "1.10.4" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.5 Search vendor "Djangoproject" for product "Django" and version "1.10.5" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | 1.10.6 Search vendor "Djangoproject" for product "Django" and version "1.10.6" | - |
Affected
| ||||||