The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2015-01-16T16:00:00

Updated: 2024-08-06T04:03:10.421Z

Reserved: 2014-11-18T00:00:00

Link: CVE-2015-0220

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2015-01-16T16:59:19.563

Modified: 2024-11-21T02:22:34.803

Link: CVE-2015-0220

cve-icon Redhat

Severity : Moderate

Publid Date: 2015-01-13T00:00:00Z

Links: CVE-2015-0220 - Bugzilla