Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2017-12794

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.

CVSS v3:

  • Severity: Medium
  • Score: 6.1
  • AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
djangoproject / django 1.10.0 1.10.0.x
djangoproject / django 1.11.2 1.11.2.x
djangoproject / django 1.11.1 1.11.1.x
djangoproject / django 1.10.3 1.10.3.x
djangoproject / django 1.11.4 1.11.4.x
djangoproject / django 1.10.1 1.10.1.x
djangoproject / django 1.10.5 1.10.5.x
djangoproject / django 1.10.7 1.10.7.x
djangoproject / django 1.10.2 1.10.2.x
djangoproject / django 1.10.6 1.10.6.x
djangoproject / django 1.10.4 1.10.4.x
djangoproject / django 1.11.0 1.11.0.x
djangoproject / django 1.11.3 1.11.3.x
Django 1.10.0 1.10.8
Django 1.11.0 1.11.5