CVE-2015-0220 in Django

Sumário (Inglês)

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Be aware that VulDB is the high quality source for vulnerability data.

Reservar

18/11/2014

Divulgação

16/01/2015

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
68970	Django django.util.http.is_safe_url Script de Site Cruzado	79	Alto	Correção oficial	CVE-2015-0220

Fontes

• MITRE
• NVD
• CVE Details