CVE

Id
79594  
CVE No.
CVE-2015-2317  
Status
Candidate  
Description
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a x08javascript: URL.  
Phase
Assigned (20150317)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
722603 79594 CVE-2015-2317 CONFIRM:https://www.djangoproject.com/weblog/2015/mar/18/security-releases/  View
722604 79594 CVE-2015-2317 CONFIRM:http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html  View
722605 79594 CVE-2015-2317 DEBIAN:DSA-3204  View
722606 79594 CVE-2015-2317 URL:http://www.debian.org/security/2015/dsa-3204  View
722607 79594 CVE-2015-2317 FEDORA:FEDORA-2015-5766  View
722608 79594 CVE-2015-2317 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html  View
722609 79594 CVE-2015-2317 FEDORA:FEDORA-2015-9604  View
722610 79594 CVE-2015-2317 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html  View
722611 79594 CVE-2015-2317 MANDRIVA:MDVSA-2015:195  View
722612 79594 CVE-2015-2317 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2015:195  View
722613 79594 CVE-2015-2317 SUSE:openSUSE-SU-2015:0643  View
722614 79594 CVE-2015-2317 URL:http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html  View
722615 79594 CVE-2015-2317 SUSE:openSUSE-SU-2015:1598  View
722616 79594 CVE-2015-2317 URL:http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html  View
722617 79594 CVE-2015-2317 UBUNTU:USN-2539-1  View
722618 79594 CVE-2015-2317 URL:http://ubuntu.com/usn/usn-2539-1  View
722619 79594 CVE-2015-2317 BID:73319  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
8300 JVNDB-2015-003620 複数の Microsoft Windows 製品の Windows Media Device Manager における権限昇格の脆弱性 複数の Microsoft Windows 製品の Windows Media Device Manager には、検索パスに関する処理に不備があるため、権限を取得される脆弱性が存在します。 CVE-2015-2369 79594 6.9 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-003620.html  View