CVE-2017-7234

Опубликовано: 04 апр. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 5.8

EPSS Низкий

Описание

A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the django.views.static.serve() view could redirect to any other domain, aka an open redirect vulnerability.

Ссылки

http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/97401
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038177
https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
Vendor Advisory
http://www.debian.org/security/2017/dsa-3835
http://www.securityfocus.com/bid/97401
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038177
https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.0:a1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.0:b1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.0:b2:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.0:c1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.16:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.8.17:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9:a1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9:b1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9:rc1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9:rc2:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.11:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.9.12:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.0:a1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.0:b1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.0:rc1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.00321

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-601

Связанные уязвимости

CVE-2017-7234

CVSS3: 6.1

ubuntu

около 8 лет назад

A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.

CVE-2017-7234

CVSS3: 4.7

redhat

около 8 лет назад

CVE-2017-7234

CVSS3: 6.1

debian

около 8 лет назад

A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before ...

GHSA-h4hv-m4h4-mhwg

CVSS3: 6.1

github

больше 6 лет назад

Django open redirect

openSUSE-SU-2018:0826-1

suse-cvrf

около 7 лет назад

Security update for python-Django

EPSS

Процентиль: 55%

0.00321

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-601