CVE-2015-2317: XSS

Q: What is the severity of CVE-2015-2317?

CVE-2015-2317 has been rated as high severity due to its potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2015-2317?

To fix CVE-2015-2317, upgrade Django to version 1.4.20 or higher, 1.5.11 or higher, 1.6.11 or higher, 1.7.7 or higher, or 1.8c1.

Q: Which versions of Django are affected by CVE-2015-2317?

Django versions prior to 1.4.20, 1.5.x before 1.5.11, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 are affected by CVE-2015-2317.

Q: What is the impact of CVE-2015-2317?

CVE-2015-2317 allows attackers to perform cross-site scripting (XSS) attacks by submitting a specially crafted URL.

Q: Is there a workaround for CVE-2015-2317?

While upgrading is the best solution for CVE-2015-2317, a temporary workaround includes validating user inputs to prevent special characters from being processed.

Published Mar 25, 2015

Updated

The utils.http.issafeurl function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.

Affected Software

57 affected componentsFixes available

pip/Django>=1.8a1<1.8c1

1.8c1

pip/Django>=1.7<1.7.7

1.7.7

pip/Django>=1.5<1.6.11

1.6.11

pip/Django<1.4.20

1.4.20

Debian Debian Linux=7.0

Fedoraproject Fedora=22

openSUSE openSUSE=13.2

djangoproject Django<=1.4.19

djangoproject Django=1.5

djangoproject Django=1.5-alpha

djangoproject Django=1.5-beta

djangoproject Django=1.5.1

djangoproject Django=1.5.2

djangoproject Django=1.5.3

djangoproject Django=1.5.4

djangoproject Django=1.5.5

djangoproject Django=1.5.6

djangoproject Django=1.5.7

djangoproject Django=1.5.8

djangoproject Django=1.5.9

djangoproject Django=1.5.10

djangoproject Django=1.5.11

djangoproject Django=1.5.12

djangoproject Django=1.6

djangoproject Django=1.6-beta1

djangoproject Django=1.6-beta2

djangoproject Django=1.6-beta3

djangoproject Django=1.6-beta4

djangoproject Django=1.6.1

djangoproject Django=1.6.2

djangoproject Django=1.6.3

djangoproject Django=1.6.4

djangoproject Django=1.6.5

djangoproject Django=1.6.6

djangoproject Django=1.6.7

djangoproject Django=1.6.8

djangoproject Django=1.6.9

djangoproject Django=1.6.10

djangoproject Django=1.7-beta1

djangoproject Django=1.7-beta2

djangoproject Django=1.7-beta3

djangoproject Django=1.7-beta4

djangoproject Django=1.7-rc1

djangoproject Django=1.7-rc2

djangoproject Django=1.7-rc3

djangoproject Django=1.7.1

djangoproject Django=1.7.2

djangoproject Django=1.7.3

djangoproject Django=1.7.4

djangoproject Django=1.7.5

djangoproject Django=1.7.6

djangoproject Django=1.8.0

Oracle Solaris=11.2

Canonical Ubuntu Linux=10.04

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=14.10

Event History

Mar 25, 2015

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

May 14, 2022

Advisory Published

via GitHub·02:06 AM

Frequently Asked Questions

What is the severity of CVE-2015-2317?

CVE-2015-2317 has been rated as high severity due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2015-2317?

To fix CVE-2015-2317, upgrade Django to version 1.4.20 or higher, 1.5.11 or higher, 1.6.11 or higher, 1.7.7 or higher, or 1.8c1.

Which versions of Django are affected by CVE-2015-2317?