CVE-2012-3442

The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

OR cpe:2.3:a:djangoproject:django:1.2:beta1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2-alpha1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1:rc1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1:beta1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0:beta:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2:rc1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.5:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:0.95:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3:beta1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0:beta2:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.7:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:0.96:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1:alpha1:*:*:*:*:*:*

Information

Published : 2012-07-31 10:55

Updated : 2013-04-10 20:29


NVD link : CVE-2012-3442

Mitre link : CVE-2012-3442


JSON object : View

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

dedicated server usa

Products Affected

djangoproject

  • django