Django Cross-site Scripting Vulnerability
Moderate severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Aug 12, 2023
Package
Affected versions
< 1.4.18
>= 1.6.0, < 1.6.10
>= 1.7.0, < 1.7.3
Patched versions
1.4.18
1.6.10
1.7.3
Description
Published by the National Vulnerability Database
Jan 16, 2015
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Aug 3, 2023
Last updated
Aug 12, 2023
The
django.util.http.is_safe_urlfunction in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a\njavascript:URL.References