p PatchFirst

CVE-2017-12794

CVE-2017-12794

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.

CVSS 6.1 · Medium · EPSS 23.6% · Public exploit · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-django Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:1.11.5-1

    Update to 1:1.11.5-1

  • python-django Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:1.11.5-1

    Update to 1:1.11.5-1

  • python-django Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:1.11.5-1

    Update to 1:1.11.5-1

  • django PyPI

    Versions
    • 1.10
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.10.4
    • 1.10.5
    • 1.10.6
    • 1.10.7
    • 1.10a1
    • 1.10b1
    • 1.10rc1
    Affected ranges
    • ECOSYSTEM: ≥ 1.10a1, < 1.10.8

    Update to 1.10.8

  • django PyPI

    Versions
    • 1.11
    • 1.11.1
    • 1.11.2
    • 1.11.3
    • 1.11.4
    • 1.11a1
    • 1.11b1
    • 1.11rc1
    Affected ranges
    • ECOSYSTEM: ≥ 1.11a1, < 1.11.5

    Update to 1.11.5

  • django PyPI

    Versions
    • 1.10
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.10.4
    • 1.10.5
    • 1.10.6
    • 1.10.7
    • 1.11
    • 1.11.1
    • 1.11.2
    • 1.11.3
    • 1.11.4
    Affected ranges
    • ECOSYSTEM: ≥ 1.10, < 1.10.8 ∪ ≥ 1.11, < 1.11.5

    Update to 1.10.8; Update to 1.11.5

Original sources

Check your server →