{"id":"CVE-2017-7233","published":"2017-04-04T17:00:00Z","modified":"2024-08-05T15:56:36Z","title":"Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the…","vendor":null,"product":null,"tier":"tail","description":{"text":"Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an \"on success\" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs \"safe\" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02404,"percentile":0.83994,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securitytracker.com/id/1038177","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1596","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/97406","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3093","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.debian.org/security/2017/dsa-3835","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1445","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1451","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2927","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1470","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.djangoproject.com/weblog/2017/apr/04/security-releases/","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1462","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":16.8,"factors":[{"name":"EPSS percentile","points":16.8}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.10a1, <1.10.7",">=1.9a1, <1.9.13",">=1.8a1, <1.8.18",">=1.10, <1.10.7",">=1.9, <1.9.13",">=1.8, <1.8.18"],"patched":["1.10.7","1.9.13","1.8.18"],"from":["GHSA-37hp-765x-j95x","PYSEC-2017-9"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0026","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2014-3730","parents":[{"from":"CVE-2014-3730","to":"CVE-2017-7233","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3","https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df","https://github.com/django/django/commit/254326cb3682389f55f886804d2c43f7b9f23e4f","https://github.com/django/django/commit/8339277518c7d8ec280070a780915304654e3b66"],"basis":"shared function","functions":["is_safe_url"]},{"kind":"similar","provenance":"machine","score":0.35,"basis":"same package + description similarity"}]},{"from":"CVE-2015-2317","to":"CVE-2017-7233","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b","https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1","https://github.com/django/django/commit/254326cb3682389f55f886804d2c43f7b9f23e4f","https://github.com/django/django/commit/8339277518c7d8ec280070a780915304654e3b66"],"basis":"shared function","functions":["is_safe_url"]}]},{"from":"CVE-2016-2512","to":"CVE-2017-7233","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350","https://github.com/django/django/commit/254326cb3682389f55f886804d2c43f7b9f23e4f","https://github.com/django/django/commit/8339277518c7d8ec280070a780915304654e3b66"],"basis":"shared function","functions":["is_safe_url"]}]}],"packageHistory":[{"cve":"CVE-2016-6186","published":"2016-08-05","fixed":"1.10rc1","kev":false},{"cve":"CVE-2016-9013","published":"2016-12-09","fixed":"1.10.3","kev":false},{"cve":"CVE-2016-9014","published":"2016-12-09","fixed":"1.10.3","kev":false},{"cve":"CVE-2017-7233","published":"2017-04-04","fixed":"1.10.7","kev":false},{"cve":"CVE-2017-7234","published":"2017-04-04","fixed":"1.10.7","kev":false},{"cve":"CVE-2017-12794","published":"2017-09-07","fixed":"1.11.5","kev":false,"link":{"from":"CVE-2017-7233","to":"CVE-2017-12794","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.10.7","toFixed":"1.10.8","daysApart":156}]}},{"cve":"CVE-2018-6188","published":"2018-02-05","fixed":"2.0.2","kev":false},{"cve":"CVE-2018-7536","published":"2018-03-09","fixed":"2.0.3","kev":false,"link":{"from":"CVE-2017-7233","to":"CVE-2018-7536","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.8.18","toFixed":"1.8.19","daysApart":339}]}},{"cve":"CVE-2018-7537","published":"2018-03-09","fixed":"2.0.3","kev":false,"link":{"from":"CVE-2017-7233","to":"CVE-2018-7537","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.8.18","toFixed":"1.8.19","daysApart":339}]}}],"package":"PyPI:Django"}}