{"id":"CVE-2012-3442","published":"2012-07-31T17:00:00Z","modified":"2024-08-06T20:05:12Z","title":"The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before…","vendor":null,"product":null,"tier":"tail","description":{"text":"The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02081,"percentile":0.8153,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2012/07/31/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:143","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://www.ubuntu.com/usn/USN-1560-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.openwall.com/lists/oss-security/2012/07/31/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.debian.org/security/2012/dsa-2529","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":16.3,"factors":[{"name":"EPSS percentile","points":16.31}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":["<1.3.2",">=1.4, <1.4.1"],"patched":["1.3.2","1.4.1"],"from":["GHSA-78vx-ggch-wghm","PYSEC-2012-2"],"provenance":"source"}],"euvd":{"id":"EUVD-2012-0003","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2012-3442","children":[{"from":"CVE-2012-3442","to":"CVE-2012-4520","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.3.2","toFixed":"1.3.4","daysApart":110},{"kind":"same-code","provenance":"machine","files":["django/http/__init__.py"],"commits":["https://github.com/django/django/commit/e34685034b60be1112160e76091e5aee60149fa1","https://github.com/django/django/commit/4dea4883e6c50d75f215a6b9bcbd95273f57c72d","https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3","https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071"],"basis":"rarely changed file"}]},{"from":"CVE-2012-3442","to":"CVE-2014-1418","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/http/__init__.py"],"commits":["https://github.com/django/django/commit/e34685034b60be1112160e76091e5aee60149fa1","https://github.com/django/django/commit/4dea4883e6c50d75f215a6b9bcbd95273f57c72d","https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769","https://github.com/django/django/commit/28e23306aa53bbbb8fb87db85f99d970b051026c"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2011-4138","published":"2011-10-19","fixed":"1.3.1","kev":false},{"cve":"CVE-2011-4139","published":"2011-10-19","fixed":"1.3.1","kev":false},{"cve":"CVE-2011-4140","published":"2011-10-19","fixed":"1.3.1","kev":false},{"cve":"CVE-2012-3442","published":"2012-07-31","fixed":"1.4.1","kev":false},{"cve":"CVE-2012-3443","published":"2012-07-31","fixed":"1.4.1","kev":false},{"cve":"CVE-2012-3444","published":"2012-07-31","fixed":"1.4.1","kev":false},{"cve":"CVE-2012-4520","published":"2012-11-18","fixed":"1.4.2","kev":false}],"package":"PyPI:Django"}}