CVE-2017-12794: XSS
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
Other sources
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.11.5 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.10.8 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.28-1~deb11u2Fixed in 2:2.2.28-1~deb11u12Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u2Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.16-1 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 1.10.8 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 1.11.5 - Configuration
Ensure DEBUG is not enabled in production (vulnerability affects the technical 500 debug page when DEBUG=True makes it accessible).
Django DEBUG = False
Event History
Frequently Asked Questions
What is CVE-2017-12794?
CVE-2017-12794 is a vulnerability in Django versions 1.10.x before 1.10.8 and 1.11.x before 1.11.5 that allows for a cross-site scripting attack.
How severe is CVE-2017-12794?
CVE-2017-12794 has a severity rating of 6.1 (medium).
How does CVE-2017-12794 affect production sites?
CVE-2017-12794 is not expected to affect most production sites, as they should have HTML autoescaping enabled.
How can I fix CVE-2017-12794?
To fix CVE-2017-12794, upgrade to Django version 1.10.8 or 1.11.5 or later.
Where can I find more information about CVE-2017-12794?
More information about CVE-2017-12794 can be found at the official Django website and security advisory.