CVE-2017-12794
Summary
| CVE | CVE-2017-12794 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2017-09-07 13:29:00 UTC |
|---|
| Updated | 2018-03-16 01:29:00 UTC |
|---|
| Description | In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Django Input Validation Flaw in Technical 500 Template Lets Remote Users Conduct Cross-Site Scripting Attacks - SecurityTracker |
SECTRACK |
www.securitytracker.com |
Third Party Advisory, VDB Entry |
| Django security releases issued: 1.11.5 and 1.10.8 | Weblog | Django |
CONFIRM |
www.djangoproject.com |
Patch, Vendor Advisory |
| USN-3559-1: Django vulnerabilities | Ubuntu security notices |
UBUNTU |
usn.ubuntu.com |
|
| Django CVE-2017-12794 Cross Site Scripting Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500580 Alpine Linux Security Update for py3-django
- 981145 Python (pip) Security Update for django (GHSA-9r8w-6x8c-6jr9)
