Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
2017-04-04T17:59:00.273
2025-04-20T01:37:25.860
Deferred
CVSSv3.0: 6.1 (MEDIUM)
AV:N/AC:M/Au:N/C:P/I:P/A:N
8.6
4.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | djangoproject | django | 1.8.0 | Yes |
| Application | djangoproject | django | 1.8.0 | Yes |
| Application | djangoproject | django | 1.8.0 | Yes |
| Application | djangoproject | django | 1.8.0 | Yes |
| Application | djangoproject | django | 1.8.0 | Yes |
| Application | djangoproject | django | 1.8.1 | Yes |
| Application | djangoproject | django | 1.8.2 | Yes |
| Application | djangoproject | django | 1.8.3 | Yes |
| Application | djangoproject | django | 1.8.4 | Yes |
| Application | djangoproject | django | 1.8.5 | Yes |
| Application | djangoproject | django | 1.8.6 | Yes |
| Application | djangoproject | django | 1.8.7 | Yes |
| Application | djangoproject | django | 1.8.8 | Yes |
| Application | djangoproject | django | 1.8.9 | Yes |
| Application | djangoproject | django | 1.8.10 | Yes |
| Application | djangoproject | django | 1.8.11 | Yes |
| Application | djangoproject | django | 1.8.12 | Yes |
| Application | djangoproject | django | 1.8.13 | Yes |
| Application | djangoproject | django | 1.8.14 | Yes |
| Application | djangoproject | django | 1.8.15 | Yes |
| Application | djangoproject | django | 1.8.16 | Yes |
| Application | djangoproject | django | 1.8.17 | Yes |
| Application | djangoproject | django | 1.9 | Yes |
| Application | djangoproject | django | 1.9 | Yes |
| Application | djangoproject | django | 1.9 | Yes |
| Application | djangoproject | django | 1.9 | Yes |
| Application | djangoproject | django | 1.9 | Yes |
| Application | djangoproject | django | 1.9.1 | Yes |
| Application | djangoproject | django | 1.9.2 | Yes |
| Application | djangoproject | django | 1.9.3 | Yes |
| Application | djangoproject | django | 1.9.4 | Yes |
| Application | djangoproject | django | 1.9.5 | Yes |
| Application | djangoproject | django | 1.9.6 | Yes |
| Application | djangoproject | django | 1.9.7 | Yes |
| Application | djangoproject | django | 1.9.8 | Yes |
| Application | djangoproject | django | 1.9.9 | Yes |
| Application | djangoproject | django | 1.9.10 | Yes |
| Application | djangoproject | django | 1.9.11 | Yes |
| Application | djangoproject | django | 1.9.12 | Yes |
| Application | djangoproject | django | 1.10.0 | Yes |
| Application | djangoproject | django | 1.10.0 | Yes |
| Application | djangoproject | django | 1.10.0 | Yes |
| Application | djangoproject | django | 1.10.0 | Yes |
| Application | djangoproject | django | 1.10.1 | Yes |
| Application | djangoproject | django | 1.10.2 | Yes |
| Application | djangoproject | django | 1.10.3 | Yes |
| Application | djangoproject | django | 1.10.4 | Yes |
| Application | djangoproject | django | 1.10.5 | Yes |
| Application | djangoproject | django | 1.10.6 | Yes |