CVE-2015-0220: XSS
The django.util.http.issafeurl function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a \njavascript: URL.
Other sources
The django.util.http.issafeurl function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0220?
CVE-2015-0220 has been classified as a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2015-0220?
To fix CVE-2015-0220, update Django to version 1.7.3, 1.6.10, or 1.4.18 or later.
What versions of Django are affected by CVE-2015-0220?
CVE-2015-0220 affects Django versions before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3.
What type of attack does CVE-2015-0220 allow?
CVE-2015-0220 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
What function in Django is vulnerable in CVE-2015-0220?
The vulnerability in CVE-2015-0220 is found in the `django.util.http.is_safe_url` function.