CVE-2015-2317

Description

The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.

How to fix CVE-2015-2317

To remediate CVE-2015-2317, upgrade the affected package to a fixed version below.

• —upgrade to 1.7.7-1 or later
• —upgrade to 1.2.3-3+squeeze13 or later
• —upgrade to 1.4.5-1+deb7u11 or later
• —upgrade to 1.4.20 or later
• —upgrade to 1.4.20 or later

Is CVE-2015-2317 being exploited?

Low — EPSS is 2.9%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 1.7.7-1
• from 0, < 1.2.3-3+squeeze13
• from 0, < 1.4.5-1+deb7u11
• from 0, < 1.4.20
• from 0, < 1.4.20, >= 1.5, < 1.6.11, >= 1.7, < 1.7.7, >= 1.8a0, < 1.8c1

CVSS scores

References (21)

• ADVISORYgithub.com/advisories/GHSA-7fq8-4pv5-5w5c
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2015-2317
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2015-2317
• ADVISORYwww.djangoproject.com/weblog/2015/mar/18/security-releases/
• PATCH