CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2017-7234
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
Severity
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h4hv-m4h4-mhwg | PyPI | django | >=1.10 <1.10.7 | 1.10.7 |
| GHSA-h4hv-m4h4-mhwg | PyPI | django | >=1.9 <1.9.13 | 1.9.13 |
| GHSA-h4hv-m4h4-mhwg | PyPI | django | >=1.8 <1.8.18 | 1.8.18 |
| PYSEC-2017-10 | PyPI | django | >=1.10 <1.10.7 >=1.9 <1.9.13 >=1.8 <1.8.18 | 1.10.7, 1.9.13, 1.8.18 |