CVE-2013-6044: djangoproject django Cross-site Scripting
Vulnerability summary
CVE-2013-6044 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in djangoproject django. EPSS estimates a 2.32% chance of exploitation in the next 30 days, higher than 83.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 04-10-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
2.32%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.32% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python-django< 1.5.2-1 | < 1.2.3-3+squeeze6 | < 1.4.5-1+deb7u1
Djangoproject1 product
- djangoEOL1.4 | 1.4.1 | 1.4.2 | 1.4.4 | 1.4.5 | 1.5 | 1.5.1 | 1.6:beta1
PyPI1 product
- django≥ 1.4, < 1.4.6 | < 1a274ccd6bc1afbdac80344c9b6e5810c1162b5f | ≥ 1.5, < 1.5.2
3 vendors · 3 products
References
18 links- www.djangoproject.com/weblog/2013/aug/13/security-releases-issuedX Refsource CONFIRMPatchVendor AdvisoryWEBARTICLE
Show all 18 references
- github.com/django/djangoPACKAGE