CVEvulnerability
CVE-2017-7234
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-04-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-601
Description
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
Affected configurations
• djangoproject django 1.8.0
• djangoproject django 1.8.1
• djangoproject django 1.8.2
• djangoproject django 1.8.3
• djangoproject django 1.8.4
• djangoproject django 1.8.5
• djangoproject django 1.8.6
• djangoproject django 1.8.7
• djangoproject django 1.8.8
• djangoproject django 1.8.9
• djangoproject django 1.8.10
• djangoproject django 1.8.11
• djangoproject django 1.8.12
• djangoproject django 1.8.13
• djangoproject django 1.8.14
• djangoproject django 1.8.15
• djangoproject django 1.8.16
• djangoproject django 1.8.17
• djangoproject django 1.9
• djangoproject django 1.9.1
• djangoproject django 1.9.2
• djangoproject django 1.9.3
• djangoproject django 1.9.4
• djangoproject django 1.9.5
• djangoproject django 1.9.6
• djangoproject django 1.9.7
• djangoproject django 1.9.8
• djangoproject django 1.9.9
• djangoproject django 1.9.10
• djangoproject django 1.9.11
• djangoproject django 1.9.12
• djangoproject django 1.10.0
• djangoproject django 1.10.1
• djangoproject django 1.10.2
• djangoproject django 1.10.3
• djangoproject django 1.10.4
• djangoproject django 1.10.5
• djangoproject django 1.10.6
Related
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- http://www.debian.org/security/2017/dsa-3835 www.debian.org
- http://www.securityfocus.com/bid/97401 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038177 www.securitytracker.com
- https://www.djangoproject.com/weblog/2017/apr/04/security-releases/ Vendor Advisory
- http://www.debian.org/security/2017/dsa-3835 www.debian.org
- http://www.securityfocus.com/bid/97401 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038177 www.securitytracker.com
- https://www.djangoproject.com/weblog/2017/apr/04/security-releases/ Vendor Advisory