Vulnerability Details : CVE-2013-6044
The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2013-6044
Probability of exploitation activity in the next 30 days: 0.76%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 79 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-6044
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2013-6044
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-6044
-
https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762
Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S. · django/django@ae35351 · GitHub
-
http://www.debian.org/security/2013/dsa-2740
Debian -- Security Information -- DSA-2740-2 python-django
-
http://rhn.redhat.com/errata/RHSA-2013-1521.html
RHSA-2013:1521 - Security Advisory - Red Hat Customer Portal
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/86437
Django is_safe_url() cross-site scripting CVE-2013-6044 Vulnerability Report
-
http://www.securitytracker.com/id/1028915
Django Input Validation Flaws Permit Cross-Site Scripting Attacks - SecurityTracker
-
http://seclists.org/oss-sec/2013/q3/369
oss-sec: [CVE request] Django 1.4.6 security release
-
http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
openSUSE-SU-2013:1541-1: moderate: update for python-django
-
http://www.securityfocus.com/bid/61777
Django 'is_safe_url()' Function Cross Site Scripting Vulnerability
-
https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f
Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S. · django/django@1a274cc · GitHub
-
https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a
Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S. · django/django@ec67af0 · GitHub
-
http://seclists.org/oss-sec/2013/q3/411
oss-sec: Re: [CVE request] Django 1.4.6 security release
-
https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued
Security releases issued | Weblog | DjangoPatch;Vendor Advisory
Products affected by CVE-2013-6044
- cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:1.5.1:*:*:*:*:*:*:*