CVE-2017-7234 Django open redirect
MediumCVSS 6.1
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the django.views.static.serve() view could redirect to any other domain, aka an open redirect vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 1.10, < 1.10.7 | 1.10.7 |
| pypi django(PyPI) | = 1.10 | No fix listed |
| pypi django(PyPI) | = 1.10.1 | No fix listed |
| pypi django(PyPI) | = 1.10.2 | No fix listed |
| pypi django(PyPI) | = 1.10.3 | No fix listed |
| pypi django(PyPI) | = 1.10.4 | No fix listed |
| pypi django(PyPI) | = 1.10.5 | No fix listed |
| pypi django(PyPI) | = 1.10.6 | No fix listed |
| pypi django(PyPI) | >= 1.9, < 1.9.13 | 1.9.13 |
| pypi django(PyPI) | = 1.9 | No fix listed |
| pypi django(PyPI) | = 1.9.1 | No fix listed |
| pypi django(PyPI) | = 1.9.10 | No fix listed |
| pypi django(PyPI) | = 1.9.11 | No fix listed |
| pypi django(PyPI) | = 1.9.12 | No fix listed |
| pypi django(PyPI) | = 1.9.2 | No fix listed |
| pypi django(PyPI) | = 1.9.3 | No fix listed |
| pypi django(PyPI) | = 1.9.4 | No fix listed |
| pypi django(PyPI) | = 1.9.5 | No fix listed |
| pypi django(PyPI) | = 1.9.6 | No fix listed |
| pypi django(PyPI) | = 1.9.7 | No fix listed |
| pypi django(PyPI) | = 1.9.8 | No fix listed |
| pypi django(PyPI) | = 1.9.9 | No fix listed |
| pypi django(PyPI) | >= 1.8, < 1.8.18 | 1.8.18 |
| pypi django(PyPI) | = 1.8 | No fix listed |
| pypi django(PyPI) | = 1.8.1 | No fix listed |
Show 91 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 1.8.10 | No fix listed |
| pypi django(PyPI) | = 1.8.11 | No fix listed |
| pypi django(PyPI) | = 1.8.12 | No fix listed |
| pypi django(PyPI) | = 1.8.13 | No fix listed |
| pypi django(PyPI) | = 1.8.14 | No fix listed |
| pypi django(PyPI) | = 1.8.15 | No fix listed |
| pypi django(PyPI) | = 1.8.16 | No fix listed |
| pypi django(PyPI) | = 1.8.17 | No fix listed |
| pypi django(PyPI) | = 1.8.2 | No fix listed |
| pypi django(PyPI) | = 1.8.3 | No fix listed |
| pypi django(PyPI) | = 1.8.4 | No fix listed |
| pypi django(PyPI) | = 1.8.5 | No fix listed |
| pypi django(PyPI) | = 1.8.6 | No fix listed |
| pypi django(PyPI) | = 1.8.7 | No fix listed |
| pypi django(PyPI) | = 1.8.8 | No fix listed |
| pypi django(PyPI) | = 1.8.9 | No fix listed |
| debian/python-django(Debian:12) | < 1:1.10.7-1 | 1:1.10.7-1 |
| debian/python-django(Debian:13) | < 1:1.10.7-1 | 1:1.10.7-1 |
| debian/python-django(Debian:14) | < 1:1.10.7-1 | 1:1.10.7-1 |
| djangoproject django | = 1.8.0 | No fix listed |
| djangoproject django | = 1.8.0-a1 | No fix listed |
| djangoproject django | = 1.8.0-b1 | No fix listed |
| djangoproject django | = 1.8.0-b2 | No fix listed |
| djangoproject django | = 1.8.0-c1 | No fix listed |
| djangoproject django | = 1.8.1 | No fix listed |
| djangoproject django | = 1.8.2 | No fix listed |
| djangoproject django | = 1.8.3 | No fix listed |
| djangoproject django | = 1.8.4 | No fix listed |
| djangoproject django | = 1.8.5 | No fix listed |
| djangoproject django | = 1.8.6 | No fix listed |
| djangoproject django | = 1.8.7 | No fix listed |
| djangoproject django | = 1.8.8 | No fix listed |
| djangoproject django | = 1.8.9 | No fix listed |
| djangoproject django | = 1.8.10 | No fix listed |
| djangoproject django | = 1.8.11 | No fix listed |
| djangoproject django | = 1.8.12 | No fix listed |
| djangoproject django | = 1.8.13 | No fix listed |
| djangoproject django | = 1.8.14 | No fix listed |
| djangoproject django | = 1.8.15 | No fix listed |
| djangoproject django | = 1.8.16 | No fix listed |
| djangoproject django | = 1.8.17 | No fix listed |
| djangoproject django | = 1.9 | No fix listed |
| djangoproject django | = 1.9-a1 | No fix listed |
| djangoproject django | = 1.9-b1 | No fix listed |
| djangoproject django | = 1.9-rc1 | No fix listed |
| djangoproject django | = 1.9-rc2 | No fix listed |
| djangoproject django | = 1.9.1 | No fix listed |
| djangoproject django | = 1.9.2 | No fix listed |
| djangoproject django | = 1.9.3 | No fix listed |
| djangoproject django | = 1.9.4 | No fix listed |
| djangoproject django | = 1.9.5 | No fix listed |
| djangoproject django | = 1.9.6 | No fix listed |
| djangoproject django | = 1.9.7 | No fix listed |
| djangoproject django | = 1.9.8 | No fix listed |
| djangoproject django | = 1.9.9 | No fix listed |
| djangoproject django | = 1.9.10 | No fix listed |
| djangoproject django | = 1.9.11 | No fix listed |
| djangoproject django | = 1.9.12 | No fix listed |
| djangoproject django | = 1.10.0 | No fix listed |
| djangoproject django | = 1.10.0-a1 | No fix listed |
| djangoproject django | = 1.10.0-b1 | No fix listed |
| djangoproject django | = 1.10.0-rc1 | No fix listed |
| djangoproject django | = 1.10.1 | No fix listed |
| djangoproject django | = 1.10.2 | No fix listed |
| djangoproject django | = 1.10.3 | No fix listed |
| djangoproject django | = 1.10.4 | No fix listed |
| djangoproject django | = 1.10.5 | No fix listed |
| djangoproject django | = 1.10.6 | No fix listed |
| alpine/py-django(Alpine:v3.10) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py-django(Alpine:v3.2) | < 1.8.18-r0 | 1.8.18-r0 |
| alpine/py-django(Alpine:v3.3) | < 1.8.18-r0 | 1.8.18-r0 |
| alpine/py-django(Alpine:v3.4) | < 1.8.18-r0 | 1.8.18-r0 |
| alpine/py-django(Alpine:v3.5) | < 1.8.18-r0 | 1.8.18-r0 |
| alpine/py-django(Alpine:v3.6) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py-django(Alpine:v3.7) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py-django(Alpine:v3.8) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py-django(Alpine:v3.9) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.11) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.12) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.13) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.14) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.15) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.16) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.17) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.18) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.19) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.20) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.21) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.22) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.23) | < 1.10.7-r0 | 1.10.7-r0 |
| alpine/py3-django(Alpine:v3.24) | < 1.10.7-r0 | 1.10.7-r0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com vendor-advisory
- github.com product
- github.com
- web.archive.org
- web.archive.org
- www.djangoproject.com technical-description vendor-advisory
- DSA-3835 vendor-advisory
- 97401 third-party-advisory vdb-entry
- 1038177 vdb-entry
- Debian Security Tracker CVE-2017-7234 vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking