CVE-2016-2512 Django XSS Vulnerability
HighCVSS 7.4
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com@attacker.com.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | < 1.8.10 | 1.8.10 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | = 1.2.7 | No fix listed |
| pypi django(PyPI) | = 1.3 | No fix listed |
| pypi django(PyPI) | = 1.3.1 | No fix listed |
| pypi django(PyPI) | = 1.3.2 | No fix listed |
| pypi django(PyPI) | = 1.3.3 | No fix listed |
| pypi django(PyPI) | = 1.3.4 | No fix listed |
| pypi django(PyPI) | = 1.3.5 | No fix listed |
| pypi django(PyPI) | = 1.3.6 | No fix listed |
Show 93 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 1.3.7 | No fix listed |
| pypi django(PyPI) | = 1.4 | No fix listed |
| pypi django(PyPI) | = 1.4.1 | No fix listed |
| pypi django(PyPI) | = 1.4.10 | No fix listed |
| pypi django(PyPI) | = 1.4.11 | No fix listed |
| pypi django(PyPI) | = 1.4.12 | No fix listed |
| pypi django(PyPI) | = 1.4.13 | No fix listed |
| pypi django(PyPI) | = 1.4.14 | No fix listed |
| pypi django(PyPI) | = 1.4.15 | No fix listed |
| pypi django(PyPI) | = 1.4.16 | No fix listed |
| pypi django(PyPI) | = 1.4.17 | No fix listed |
| pypi django(PyPI) | = 1.4.18 | No fix listed |
| pypi django(PyPI) | = 1.4.19 | No fix listed |
| pypi django(PyPI) | = 1.4.2 | No fix listed |
| pypi django(PyPI) | = 1.4.20 | No fix listed |
| pypi django(PyPI) | = 1.4.21 | No fix listed |
| pypi django(PyPI) | = 1.4.22 | No fix listed |
| pypi django(PyPI) | = 1.4.3 | No fix listed |
| pypi django(PyPI) | = 1.4.4 | No fix listed |
| pypi django(PyPI) | = 1.4.5 | No fix listed |
| pypi django(PyPI) | = 1.4.6 | No fix listed |
| pypi django(PyPI) | = 1.4.7 | No fix listed |
| pypi django(PyPI) | = 1.4.8 | No fix listed |
| pypi django(PyPI) | = 1.4.9 | No fix listed |
| pypi django(PyPI) | = 1.5 | No fix listed |
| pypi django(PyPI) | = 1.5.1 | No fix listed |
| pypi django(PyPI) | = 1.5.10 | No fix listed |
| pypi django(PyPI) | = 1.5.11 | No fix listed |
| pypi django(PyPI) | = 1.5.12 | No fix listed |
| pypi django(PyPI) | = 1.5.2 | No fix listed |
| pypi django(PyPI) | = 1.5.3 | No fix listed |
| pypi django(PyPI) | = 1.5.4 | No fix listed |
| pypi django(PyPI) | = 1.5.5 | No fix listed |
| pypi django(PyPI) | = 1.5.6 | No fix listed |
| pypi django(PyPI) | = 1.5.7 | No fix listed |
| pypi django(PyPI) | = 1.5.8 | No fix listed |
| pypi django(PyPI) | = 1.5.9 | No fix listed |
| pypi django(PyPI) | = 1.6 | No fix listed |
| pypi django(PyPI) | = 1.6.1 | No fix listed |
| pypi django(PyPI) | = 1.6.10 | No fix listed |
| pypi django(PyPI) | = 1.6.11 | No fix listed |
| pypi django(PyPI) | = 1.6.2 | No fix listed |
| pypi django(PyPI) | = 1.6.3 | No fix listed |
| pypi django(PyPI) | = 1.6.4 | No fix listed |
| pypi django(PyPI) | = 1.6.5 | No fix listed |
| pypi django(PyPI) | = 1.6.6 | No fix listed |
| pypi django(PyPI) | = 1.6.7 | No fix listed |
| pypi django(PyPI) | = 1.6.8 | No fix listed |
| pypi django(PyPI) | = 1.6.9 | No fix listed |
| pypi django(PyPI) | = 1.7 | No fix listed |
| pypi django(PyPI) | = 1.7.1 | No fix listed |
| pypi django(PyPI) | = 1.7.10 | No fix listed |
| pypi django(PyPI) | = 1.7.11 | No fix listed |
| pypi django(PyPI) | = 1.7.2 | No fix listed |
| pypi django(PyPI) | = 1.7.3 | No fix listed |
| pypi django(PyPI) | = 1.7.4 | No fix listed |
| pypi django(PyPI) | = 1.7.5 | No fix listed |
| pypi django(PyPI) | = 1.7.6 | No fix listed |
| pypi django(PyPI) | = 1.7.7 | No fix listed |
| pypi django(PyPI) | = 1.7.8 | No fix listed |
| pypi django(PyPI) | = 1.7.9 | No fix listed |
| pypi django(PyPI) | = 1.8 | No fix listed |
| pypi django(PyPI) | = 1.8.1 | No fix listed |
| pypi django(PyPI) | = 1.8.2 | No fix listed |
| pypi django(PyPI) | = 1.8.3 | No fix listed |
| pypi django(PyPI) | = 1.8.4 | No fix listed |
| pypi django(PyPI) | = 1.8.5 | No fix listed |
| pypi django(PyPI) | = 1.8.6 | No fix listed |
| pypi django(PyPI) | = 1.8.7 | No fix listed |
| pypi django(PyPI) | = 1.8.8 | No fix listed |
| pypi django(PyPI) | = 1.8.9 | No fix listed |
| pypi django(PyPI) | = 1.8a1 | No fix listed |
| pypi django(PyPI) | = 1.8b1 | No fix listed |
| pypi django(PyPI) | = 1.8b2 | No fix listed |
| pypi django(PyPI) | = 1.8c1 | No fix listed |
| pypi django(PyPI) | >= 1.9a1, < 1.9.3 | 1.9.3 |
| pypi django(PyPI) | = 1.9 | No fix listed |
| pypi django(PyPI) | = 1.9.1 | No fix listed |
| pypi django(PyPI) | = 1.9.2 | No fix listed |
| pypi django(PyPI) | = 1.9a1 | No fix listed |
| pypi django(PyPI) | = 1.9b1 | No fix listed |
| pypi django(PyPI) | = 1.9rc1 | No fix listed |
| pypi django(PyPI) | = 1.9rc2 | No fix listed |
| pypi django(PyPI) | >= 1.9, < 1.9.3 | 1.9.3 |
| pypi django(PyPI) | = 1.7a2 | No fix listed |
| pypi django(PyPI) | = 1.0 | No fix listed |
| debian/python-django(Debian:12) | < 1.9.4-1 | 1.9.4-1 |
| debian/python-django(Debian:13) | < 1.9.4-1 | 1.9.4-1 |
| debian/python-django(Debian:14) | < 1.9.4-1 | 1.9.4-1 |
| djangoproject django | = 1.8.9 | No fix listed |
| djangoproject django | = 1.9 | No fix listed |
| djangoproject django | = 1.9.1 | No fix listed |
| djangoproject django | = 1.9.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com product
- github.com
- web.archive.org
- web.archive.org
- www.djangoproject.com technical-description vendor-advisory
- RHSA-2016:0502 vendor-advisory
- RHSA-2016:0504 vendor-advisory
- RHSA-2016:0505 vendor-advisory
- RHSA-2016:0506 vendor-advisory
- DSA-3544 vendor-advisory
- www.oracle.com
- USN-2915-1 vendor-advisory
- USN-2915-2 vendor-advisory
- USN-2915-3 vendor-advisory
- 83879 vdb-entry
- 1035152 vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2016-2512 vendor-advisory
- bugs.debian.org issue-tracking