Description

The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.

Remediation

References

CVE-2012-3442

Related Vulnerabilities

WordPress Plugin Breezing Forms Cross-Site Scripting (1.2.7.42)

MySQL Other Vulnerability (CVE-2001-1454)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2246)

Moodle CVE-2022-30598 Vulnerability (CVE-2022-30598)

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5285)

Severity

Medium

Classification

CVE-2012-3442 CWE-707

Tags

Missing Update Known Vulnerabilities