Search for vulnerabilities
Vulnerability details: VCID-w5zz-sb5k-aaan
Vulnerability ID VCID-w5zz-sb5k-aaan
Aliases CVE-2017-12794
GHSA-9r8w-6x8c-6jr9
PYSEC-2017-44
Summary In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
Status Published
Exploitability 0.5
Weighted Severity 7.1
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12794.json
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00223 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00223 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.00223 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.10889 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.13032 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.13032 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.13032 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.13032 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.14655 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.14655 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.14655 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.14655 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.14655 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.14655 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.14655 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.16579 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.17361 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
epss 0.21092 https://api.first.org/data/v1/epss?cve=CVE-2017-12794
rhbs low https://bugzilla.redhat.com/show_bug.cgi?id=1486451
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-9r8w-6x8c-6jr9
cvssv3.1 3.7 https://github.com/django/django
generic_textual MODERATE https://github.com/django/django
cvssv3.1 6.1 https://github.com/django/django/commit/58e08e80e362db79eb0fd775dc81faad90dca47a
generic_textual MODERATE https://github.com/django/django/commit/58e08e80e362db79eb0fd775dc81faad90dca47a
cvssv3.1 6.1 https://github.com/django/django/commit/e35a0c56086924f331e9422daa266e907a4784cc
generic_textual MODERATE https://github.com/django/django/commit/e35a0c56086924f331e9422daa266e907a4784cc
cvssv3.1 6.1 https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-44.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-44.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2017-12794
cvssv3 6.1 https://nvd.nist.gov/vuln/detail/CVE-2017-12794
cvssv3.1 7.5 https://usn.ubuntu.com/3559-1
generic_textual HIGH https://usn.ubuntu.com/3559-1
cvssv3.1 6.1 https://web.archive.org/web/20170927072701/http://www.securitytracker.com/id/1039264
generic_textual MODERATE https://web.archive.org/web/20170927072701/http://www.securitytracker.com/id/1039264
cvssv3.1 6.1 https://web.archive.org/web/20200227150819/http://www.securityfocus.com/bid/100643
generic_textual MODERATE https://web.archive.org/web/20200227150819/http://www.securityfocus.com/bid/100643
cvssv3.1 6.1 https://www.djangoproject.com/weblog/2017/sep/05/security-releases
generic_textual MODERATE https://www.djangoproject.com/weblog/2017/sep/05/security-releases
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12794.json
https://api.first.org/data/v1/epss?cve=CVE-2017-12794
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794
https://github.com/django/django
https://github.com/django/django/commit/58e08e80e362db79eb0fd775dc81faad90dca47a
https://github.com/django/django/commit/e35a0c56086924f331e9422daa266e907a4784cc
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-44.yaml
https://usn.ubuntu.com/3559-1
https://usn.ubuntu.com/3559-1/
https://web.archive.org/web/20170927072701/http://www.securitytracker.com/id/1039264
https://web.archive.org/web/20200227150819/http://www.securityfocus.com/bid/100643
https://www.djangoproject.com/weblog/2017/sep/05/security-releases
https://www.djangoproject.com/weblog/2017/sep/05/security-releases/
http://www.securityfocus.com/bid/100643
http://www.securitytracker.com/id/1039264
1486451 https://bugzilla.redhat.com/show_bug.cgi?id=1486451
874415 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874415
cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.10.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.10.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.10.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.10.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.10.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.10.5:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.10.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.10.7:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.11.0:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.11.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.11.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.11.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.11.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.11.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.11.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.11.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.11.4:*:*:*:*:*:*:*
CVE-2017-12794 https://nvd.nist.gov/vuln/detail/CVE-2017-12794
GHSA-9r8w-6x8c-6jr9 https://github.com/advisories/GHSA-9r8w-6x8c-6jr9
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12794.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/58e08e80e362db79eb0fd775dc81faad90dca47a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/e35a0c56086924f331e9422daa266e907a4784cc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-44.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12794
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12794
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://usn.ubuntu.com/3559-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://web.archive.org/web/20170927072701/http://www.securitytracker.com/id/1039264
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://web.archive.org/web/20200227150819/http://www.securityfocus.com/bid/100643
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.djangoproject.com/weblog/2017/sep/05/security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.60367
EPSS Score 0.00219
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.