NVD

Id
41245  
Name
CVE-2013-6044  
Description
The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL"s scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2013-10-04  
Modified Date
2013-12-10  
Seq
2013-6044  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
208757 41245 CVE-2013-6044 openSUSE-SU-2013:1541  View
208758 41245 CVE-2013-6044 RHSA-2013:1521  View
208759 41245 CVE-2013-6044 [oss-security] 20130814 [CVE request] Django 1.4.6 security release  View
208760 41245 CVE-2013-6044 [oss-security] 20130819 Re: [CVE request] Django 1.4.6 security release  View
208761 41245 CVE-2013-6044 61777  View
208762 41245 CVE-2013-6044 1028915  View
208763 41245 CVE-2013-6044 django-issafeurl-xss(86437)  View
208764 41245 CVE-2013-6044 https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f  View
208765 41245 CVE-2013-6044 https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762  View
208766 41245 CVE-2013-6044 https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a  View
208767 41245 CVE-2013-6044 https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22932 JVNDB-2013-004507 Django の utils/http.py 内の is_safe_url 関数におけるクロスサイトスクリプティングの脆弱性 Django の utils/http.py 内の is_safe_url 関数は、URL スキームを HTTP または HTTPS でない場合にも安全なものとして扱うため、クロスサイトスクリプティングを実行される、またはその他の脆弱性が存在します。 CVE-2013-6044 65986 CVE-2013-6044 41245 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004507.html 2013-08-13 2014-02-18 View