CVE-2016-2512: XSS
The utils.http.issafeurl function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.
Other sources
The utils.http.issafeurl function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2512?
CVE-2016-2512 is classified as a high severity vulnerability due to its potential for facilitating phishing attacks and cross-site scripting.
How do I fix CVE-2016-2512?
You can fix CVE-2016-2512 by upgrading Django to versions 1.8.10 or 1.9.3 and above.
Which versions of Django are affected by CVE-2016-2512?
Django versions 1.8.9 and 1.9.0 to 1.9.2 are affected by CVE-2016-2512.
What kind of attacks can CVE-2016-2512 allow?
CVE-2016-2512 can allow remote attackers to redirect users, which can lead to phishing or potentially cross-site scripting attacks.
Is CVE-2016-2512 still a concern for users of Django?
Yes, users of affected Django versions should be concerned until they apply the necessary updates to mitigate CVE-2016-2512.