CVE-2012-3442: XSS
The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.
Other sources
The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3442?
The severity of CVE-2012-3442 is classified as medium due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2012-3442?
To fix CVE-2012-3442, upgrade Django to version 1.4.1 or later, or 1.3.2 or later.
Which Django versions are affected by CVE-2012-3442?
Django versions 1.0 through 1.3 and any version before 1.4.1 are affected by CVE-2012-3442.
Can CVE-2012-3442 lead to data exposure?
Yes, CVE-2012-3442 can lead to data exposure through XSS vulnerabilities by allowing malicious scripts to be executed.
What components of Django are vulnerable in CVE-2012-3442?
The vulnerable components in CVE-2012-3442 are `django.http.HttpResponseRedirect` and `django.http.HttpResponsePermanentRedirect`.