CVE-2017-12794
medium · 6.1A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
6.1
CVSS
23.6%
EPSS (exploit prob.)
98th
EPSS percentile
2017-09-07
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| djangoproject | django | 1.10.0 |
| djangoproject | django | 1.10.1 |
| djangoproject | django | 1.10.2 |
| djangoproject | django | 1.10.3 |
| djangoproject | django | 1.10.4 |
| djangoproject | django | 1.10.5 |
| djangoproject | django | 1.10.6 |
| djangoproject | django | 1.10.7 |
| djangoproject | django | 1.11.0 |
| djangoproject | django | 1.11.1 |
| djangoproject | django | 1.11.2 |
| djangoproject | django | 1.11.3 |
| djangoproject | django | 1.11.4 |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/100643
- http://www.securitytracker.com/id/1039264
- https://usn.ubuntu.com/3559-1/
- https://www.djangoproject.com/weblog/2017/sep/05/security-releases/
- http://www.securityfocus.com/bid/100643
- http://www.securitytracker.com/id/1039264
- https://usn.ubuntu.com/3559-1/
- https://www.djangoproject.com/weblog/2017/sep/05/security-releases/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2017-12794