Search for vulnerabilities
Vulnerability details: VCID-a6xe-py95-aaab
Vulnerability ID VCID-a6xe-py95-aaab
Aliases CVE-2013-6044
GHSA-9cwg-mhxf-hh59
PYSEC-2013-21
Summary The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 6.1 http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
cvssv3.1 6.1 http://rhn.redhat.com/errata/RHSA-2013-1521.html
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-1521.html
rhas Moderate https://access.redhat.com/errata/RHSA-2013:1521
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00761 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00805 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00805 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00805 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.00805 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.02198 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
epss 0.04123 https://api.first.org/data/v1/epss?cve=CVE-2013-6044
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1016394
cvssv3.1 6.1 http://seclists.org/oss-sec/2013/q3/369
generic_textual MODERATE http://seclists.org/oss-sec/2013/q3/369
cvssv3.1 6.1 http://seclists.org/oss-sec/2013/q3/411
generic_textual MODERATE http://seclists.org/oss-sec/2013/q3/411
generic_textual MODERATE http://secunia.com/advisories/54476
cvssv3.1 6.1 https://exchange.xforce.ibmcloud.com/vulnerabilities/86437
generic_textual MODERATE https://exchange.xforce.ibmcloud.com/vulnerabilities/86437
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-9cwg-mhxf-hh59
cvssv3.1 3.7 https://github.com/django/django
generic_textual MODERATE https://github.com/django/django
cvssv3.1 6.1 https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f
generic_textual MODERATE https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f
cvssv3.1 6.1 https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762
generic_textual MODERATE https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762
cvssv3.1 6.1 https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a
generic_textual MODERATE https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a
cvssv3.1 6.1 https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2013-21.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2013-21.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2013-6044
cvssv3.1 6.1 https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued
generic_textual MODERATE https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued
cvssv3.1 6.1 http://www.debian.org/security/2013/dsa-2740
generic_textual MODERATE http://www.debian.org/security/2013/dsa-2740
generic_textual MODERATE http://www.securityfocus.com/bid/61777
generic_textual MODERATE http://www.securitytracker.com/id/1028915
Reference id Reference type URL
http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
http://rhn.redhat.com/errata/RHSA-2013-1521.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6044.json
https://api.first.org/data/v1/epss?cve=CVE-2013-6044
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6044
http://seclists.org/oss-sec/2013/q3/369
http://seclists.org/oss-sec/2013/q3/411
http://secunia.com/advisories/54476
https://exchange.xforce.ibmcloud.com/vulnerabilities/86437
https://github.com/django/django
https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f
https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762
https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2013-21.yaml
https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued
http://www.debian.org/security/2013/dsa-2740
http://www.securityfocus.com/bid/61777
http://www.securitytracker.com/id/1028915
1016394 https://bugzilla.redhat.com/show_bug.cgi?id=1016394
cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.4.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.4.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.4.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.4.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.5:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.5.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:*
CVE-2013-6044 https://nvd.nist.gov/vuln/detail/CVE-2013-6044
GHSA-9cwg-mhxf-hh59 https://github.com/advisories/GHSA-9cwg-mhxf-hh59
RHSA-2013:1521 https://access.redhat.com/errata/RHSA-2013:1521
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://rhn.redhat.com/errata/RHSA-2013-1521.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://seclists.org/oss-sec/2013/q3/369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://seclists.org/oss-sec/2013/q3/411
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://exchange.xforce.ibmcloud.com/vulnerabilities/86437
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2013-21.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2013-6044
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://www.debian.org/security/2013/dsa-2740
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.81566
EPSS Score 0.00761
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.