CVE-2016-2512: djangoproject django
Vulnerability summary
CVE-2016-2512 is a high (CVSS 7.4) vulnerability in djangoproject django. EPSS estimates a 4.05% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities.
Not severe (CVSS 7.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 5Timeline
- 08-04-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
EPSS trend
Probability
4.05%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.05% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- python-django< 1.9.4-1
Djangoproject1 product
- djangoEOL1.8.9 | 1.9 | 1.9.1 | 1.9.2
PyPI1 product
- django< 1.8.10 | ≥ 1.9a1, < 1.9.3 | < c5544d289233f501917e25970c03ed444abbd4f0 | ≥ 1.9, < 1.9.3
Ubuntu1 product
- python-django< 1.6.1-2ubuntu0.12
4 vendors · 4 products
References
26 linksShow all 26 references
- www.djangoproject.com/weblog/2016/mar/01/security-releases/X Refsource CONFIRMVendor AdvisoryARTICLEREPORT
- github.com/django/djangoPACKAGE
