SB2013091607 - Multiple vulnerabilities in Django

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2013091607

SB2013091607 - Multiple vulnerabilities in Django

Published: September 16, 2013 Updated: February 2, 2022

Security Bulletin ID SB2013091607
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2013-6044)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.


2) Cross-site scripting (CVE-ID: CVE-2013-4249)

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


3) Path traversal (CVE-ID: CVE-2013-4315)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a . (dot dot) in a ssi template tag.


Remediation

Install update from vendor's website.

References