100643vdb entry
http://www.securityfocus.com/bid/100643 CVE-2017-12794
Nuclei
Django vulnerable to XSS on 500 pages
Record summary
EIP currently links 1 Nuclei template to CVE-2017-12794.
Description
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
DjangoBrowse PyPI / Django | GitHub Advisory | 1.10a1 to < 1.10.8 · Fixed in 1.10.8 | affected |
| 1.11a1 to < 1.11.5 · Fixed in 1.11.5 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMDjango Debug Page - Cross-Site ScriptingCVSS 6.1
Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5 has HTML autoescaping disabled in a portion of the template for the technical 500 debug page. We detected that right circumstances (DEBUG=True) are present to allow a cross-site scripting attack.
Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information.
Remediation
Upgrade to a patched version of Django or apply the necessary security patches provided by the Django project.
WeaknessesCWE-79
Authorspikpikcu
Template tagscve2017cvexssdjangodjangoprojectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:*
Shodan: cpe:"cpe:2.3:a:djangoproject:django"
https://twitter.com/sec715/status/1406779605055270914 https://nvd.nist.gov/vuln/detail/CVE-2017-12794 https://www.djangoproject.com/weblog/2017/sep/05/security-releases/ http://web.archive.org/web/20211207172022/https://securitytracker.com/id/1039264 http://www.securitytracker.com/id/1039264
Source: ProjectDiscovery
References
121039264vdb entry
http://www.securitytracker.com/id/1039264 github.com
https://github.com/advisories/GHSA-9r8w-6x8c-6jr9 github.com
https://github.com/django/django github.com
https://github.com/django/django/commit/58e08e80e362db79eb0fd775dc81faad90dca47a github.com
https://github.com/django/django/commit/e35a0c56086924f331e9422daa266e907a4784cc github.com
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-44.yaml nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-12794 USN-3559-1Vendor advisory
https://usn.ubuntu.com/3559-1 web.archive.org
https://web.archive.org/web/20170927072701/http://www.securitytracker.com/id/1039264 web.archive.org
https://web.archive.org/web/20200227150819/http://www.securityfocus.com/bid/100643 djangoproject.comConfirmation
https://www.djangoproject.com/weblog/2017/sep/05/security-releases