NetSight
IP …
medium4.3

CVE-2015-0220

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, wh…

Impact

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10
DjangoprojectDjango
through 1.4.17
Versions 1.6, 1.6.1, 1.6.2, 1.6.3, 1.6.4

Weakness classification

CWE-79

References