GitHub Advisoryadvisory · PyPI

GHSA-9r8w-6x8c-6jr9 Django vulnerable to XSS on 500 pages

MEDIUM Published 2019-01-04 Modified 2024-09-18 Official page ↗
Aliases
CVE-2017-12794
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• PyPI Django: >= 1.10a1, < 1.10.8 → fixed in 1.10.8 • PyPI Django: >= 1.11a1, < 1.11.5 → fixed in 1.11.5

Description

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with `DEBUG = True` (which makes this page accessible) in your production settings.

Related

Alias · CVE (1)

  • CVE-2017-12794 In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References