netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-37hp-765x-j95x
GHSA-9cwg-mhxf-hh59
This commit is contained in:
advisory-database[bot]
2024-09-18 16:11:06 +00:00
parent 73f1f11b02
commit 0f21ca7161
2 changed files with 44 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2019/01/GHSA-37hp-765x-j95x/GHSA-37hp-765x-j95x.json
+16 -16
View File
@@ -1,31 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-37hp-765x-j95x",
"modified": "2024-03-07T22:55:42Z",
"modified": "2024-09-18T16:08:51Z",
"published": "2019-01-04T17:50:26Z",
"aliases": [
"CVE-2017-7233"
],
"summary": "Django Open redirect and possible XSS attack via user-supplied numeric redirect URLs",
"summary": "Django open redirect and possible XSS attack via user-supplied numeric redirect URLs",
"details": "Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an \"on success\" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs \"safe\" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django"
"name": "Django"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.10"
"introduced": "1.10a1"
},
{
"fixed": "1.10.7"
@@ -37,14 +41,14 @@
{
"package": {
"ecosystem": "PyPI",
"name": "django"
"name": "Django"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.9"
"introduced": "1.9a1"
},
{
"fixed": "1.9.13"
@@ -56,14 +60,14 @@
{
"package": {
"ecosystem": "PyPI",
"name": "django"
"name": "Django"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.8"
"introduced": "1.8a1"
},
{
"fixed": "1.8.18"
@@ -126,6 +130,10 @@
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-9.yaml"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2017/apr/04/security-releases"
@@ -133,14 +141,6 @@
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3835"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97406"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038177"
}
],
"database_specific": {
advisories/github-reviewed/2022/05/GHSA-9cwg-mhxf-hh59/GHSA-9cwg-mhxf-hh59.json
+28 -19
View File
@@ -1,28 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9cwg-mhxf-hh59",
"modified": "2023-08-17T23:09:26Z",
"modified": "2024-09-18T16:09:42Z",
"published": "2022-05-17T00:23:23Z",
"aliases": [
"CVE-2013-6044"
],
"summary": "Django Cross-site scripting (XSS) vulnerability via is_safe_url function ",
"summary": "Django cross-site scripting (XSS) vulnerability via is_safe_url function ",
"details": "The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by \"the login view in django.contrib.auth.views\" and the javascript: scheme.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django"
"name": "Django"
},
"ecosystem_specific": {
"affected_functions": [
"django.utils.http.is_safe_url"
]
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.4.0"
"introduced": "1.4"
},
{
"fixed": "1.4.6"
@@ -34,14 +46,19 @@
{
"package": {
"ecosystem": "PyPI",
"name": "django"
"name": "Django"
},
"ecosystem_specific": {
"affected_functions": [
"django.utils.http.is_safe_url"
]
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.5.0"
"introduced": "1.5"
},
{
"fixed": "1.5.2"
@@ -76,6 +93,10 @@
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2013-21.yaml"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued"
@@ -96,21 +117,9 @@
"type": "WEB",
"url": "http://seclists.org/oss-sec/2013/q3/411"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/54476"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2013/dsa-2740"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/61777"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1028915"
}
],
"database_specific": {