CVE-2015-2317: Django cross-site scripting (XSS) attack via user-supplied redirect URLs
(updated )
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
References
- github.com/advisories/GHSA-7fq8-4pv5-5w5c
- github.com/django/django
- github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b
- github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1
- github.com/django/django/commit/5510f070711540aaa8d3707776cd77494e688ef9
- github.com/django/django/commit/770427c2896a078925abfca2317486b284d22f04
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-9.yaml
- nvd.nist.gov/vuln/detail/CVE-2015-2317
- web.archive.org/web/20200228131706/http://www.securityfocus.com/bid/73319
- www.djangoproject.com/weblog/2015/mar/18/security-releases
Code Behaviors & Features
Detect and mitigate CVE-2015-2317 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →