Vulnerability advisory

GHSA-9r8w-6x8c-6jr9

Django vulnerable to XSS on 500 pages

Published Jan 4, 2019Updated Sep 18, 2024OSV record ↗

Also known as CVE-2017-12794PYSEC-2017-44

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`1.10a1` to before 1.10.8	`1.10.8`Advisories →
Also listed as affected (11) `1.10` `1.10.1` `1.10.2` `1.10.3` `1.10.4` `1.10.5` `1.10.6` `1.10.7` `1.10a1` `1.10b1` `1.10rc1`
`1.11a1` to before 1.11.5	`1.11.5`Advisories →
Also listed as affected (8) `1.11` `1.11.1` `1.11.2` `1.11.3` `1.11.4` `1.11a1` `1.11b1` `1.11rc1`

Description

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.

GHSA-9r8w-6x8c-6jr9

Affected versions

django PyPI

Description

References