CVE-2011-0697

Django < 1.1.4 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.

References (18)

[Patch] http://openwall.com/lists/oss-security/2011/02/09/6

[Third Party Advisory] http://secunia.com/advisories/43230

[Third Party Advisory] http://secunia.com/advisories/43297

[Third Party Advisory] http://secunia.com/advisories/43382

[Third Party Advisory] http://secunia.com/advisories/43426

[Patch, Vendor Advisory] http://www.djangoproject.com/weblog/2011/feb/08/security/

[Vendor Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2011:031

[Vendor Advisory] http://www.ubuntu.com/usn/USN-1066-1

[Patch] https://bugzilla.redhat.com/show_bug.cgi?id=676359

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/46296

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054207.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054208.html

[Third Party Advisory] http://www.debian.org/security/2011/dsa-2163

[Third Party Advisory] http://www.vupen.com/english/advisories/2011/0372

[Third Party Advisory] http://www.vupen.com/english/advisories/2011/0388

[Third Party Advisory] http://www.vupen.com/english/advisories/2011/0429

[Third Party Advisory] http://www.vupen.com/english/advisories/2011/0439

[Third Party Advisory] http://www.vupen.com/english/advisories/2011/0441

Scores

EPSS 0.0296

EPSS Percentile 86.3%

Classification

CWE

CWE-79

Status published

Affected Products (11)

djangoproject/django

pypi/Django < 1.1.4PyPI

n/a/n/a

Timeline

Published Feb 14, 2011

Tracked Since Feb 18, 2026