Description

The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.

Remediation

References

CVE-2015-2317

Related Vulnerabilities

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-27949)

WordPress Plugin WP Activity Log Cross-Site Scripting (2.4.3)

SugarCRM Improper Input Validation Vulnerability (CVE-2011-0745)

Joomla Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-9837)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8757)

Severity

Medium

Classification

CVE-2015-2317 CWE-707

Tags

Missing Update Known Vulnerabilities