CVE-2017-7234

Description

A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the django.views.static.serve() view could redirect to any other domain, aka an open redirect vulnerability.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.323

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-7233,CVE-2017-7234 are fixed in Python-django 1.10.7	Windows
Vulnerabilities CVE-2017-7233,CVE-2017-7234 are fixed in Python-django 1.8.18	Windows
Vulnerabilities CVE-2017-7233,CVE-2017-7234 are fixed in Python-django 1.9.13	Windows
High-level Python web development framework (USN-3254-1) python-django_1.8.7-1ubuntu5.5_all.deb	Linux
High-level Python web development framework (USN-3254-1) python-django_1.8.7-1ubuntu8.2_all.deb	Linux
High-level Python web development framework (USN-3254-1) python-django_1.3.1-4ubuntu1.23_all.deb	Linux
High-level Python web development framework (USN-3254-1) python-django_1.6.11-0ubuntu1.1_all.deb	Linux
High-level Python web development framework (USN-3254-1) python3-django_1.8.7-1ubuntu5.5_all.deb	Linux
High-level Python web development framework (USN-3254-1) python3-django_1.8.7-1ubuntu8.2_all.deb	Linux
Vulnerabilities CVE-2017-7233,CVE-2017-7234 are fixed in Python-django for linux 1.10.7	Linux
Vulnerabilities CVE-2017-7233,CVE-2017-7234 are fixed in Python-django for linux 1.8.18	Linux
Vulnerabilities CVE-2017-7233,CVE-2017-7234 are fixed in Python-django for linux 1.9.13	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234