CVE-2017-12794: Django vulnerable to XSS on 500 pages
(updated )
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn’t affect most production sites since you shouldn’t run with DEBUG = True (which makes this page accessible) in your production settings.
References
- github.com/advisories/GHSA-9r8w-6x8c-6jr9
- github.com/django/django
- github.com/django/django/commit/58e08e80e362db79eb0fd775dc81faad90dca47a
- github.com/django/django/commit/e35a0c56086924f331e9422daa266e907a4784cc
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-44.yaml
- nvd.nist.gov/vuln/detail/CVE-2017-12794
- usn.ubuntu.com/3559-1
- web.archive.org/web/20170927072701/http://www.securitytracker.com/id/1039264
- web.archive.org/web/20200227150819/http://www.securityfocus.com/bid/100643
- www.djangoproject.com/weblog/2017/sep/05/security-releases
Code Behaviors & Features
Detect and mitigate CVE-2017-12794 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →