CVE-2011-0697: XSS
Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.
Other sources
http://www.djangoproject.com/weblog/2011/feb/08/security/
Django's form system includes form fields and widgets for performing file uploads; in rendering these fields, the name of the file currently stored in the field is displayed. In the process of rendering, the filename is displayed without being escaped, as reported by Trac user "e.generalov".
In many cases this does not result in a cross-site-scripting vulnerability, as file-storage backends can and are encouraged to (and the default backends provided with Django do) sanitize the supplied filename according to their requirements. However, the risk of a vulnerability appearing in a backend which does not sanitize, or which performs insufficient sanitization, is such that Django will now automatically escape filenames in form rendering.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0697?
The severity of CVE-2011-0697 is classified as medium due to potential exposure of sensitive file information.
How do I fix CVE-2011-0697?
To fix CVE-2011-0697, upgrade Django to version 1.2.5 or later, or 1.1.4 or later.
What versions of Django are affected by CVE-2011-0697?
CVE-2011-0697 affects Django versions 1.1 through 1.2.4 inclusively.
What type of vulnerability is CVE-2011-0697?
CVE-2011-0697 is a flaw in the file upload handling within Django's form system.
Is there a workaround for CVE-2011-0697?
There is no well-documented workaround for CVE-2011-0697 other than upgrading to a fixed version.