Search for vulnerabilities
Vulnerability details: VCID-yr8m-4dhu-aaac
Vulnerability ID VCID-yr8m-4dhu-aaac
Aliases CVE-2015-0220
GHSA-gv98-g628-m9x5
PYSEC-2015-5
Summary The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 http://advisories.mageia.org/MGASA-2015-0026.html
generic_textual MODERATE http://advisories.mageia.org/MGASA-2015-0026.html
cvssv3.1 7.5 http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html
generic_textual MODERATE http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html
cvssv3.1 7.5 http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
generic_textual MODERATE http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
cvssv3.1 6.1 http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-0220.html
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00724 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.0122 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
epss 0.02316 https://api.first.org/data/v1/epss?cve=CVE-2015-0220
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1179675
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0219
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0220
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0221
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-gv98-g628-m9x5
cvssv3.1 3.7 https://github.com/django/django
generic_textual MODERATE https://github.com/django/django
cvssv3.1 6.1 https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.18.txt#L34-L46
generic_textual MODERATE https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.18.txt#L34-L46
cvssv3.1 6.1 https://github.com/django/django/commit/4c241f1b710da6419d9dca160e80b23b82db7758
generic_textual MODERATE https://github.com/django/django/commit/4c241f1b710da6419d9dca160e80b23b82db7758
cvssv3.1 6.1 https://github.com/django/django/commit/72e0b033662faa11bb7f516f18a132728aa0ae28
generic_textual MODERATE https://github.com/django/django/commit/72e0b033662faa11bb7f516f18a132728aa0ae28
cvssv3.1 6.1 https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89
generic_textual MODERATE https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89
cvssv3.1 6.1 https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-5.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-5.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2015-0220
generic_textual Medium https://ubuntu.com/security/notices/USN-2469-1
cvssv3.1 7.5 https://web.archive.org/web/20150128111656/http://secunia.com/advisories/62285
generic_textual MODERATE https://web.archive.org/web/20150128111656/http://secunia.com/advisories/62285
cvssv3.1 6.1 https://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109
generic_textual MODERATE https://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109
cvssv3.1 7.5 https://web.archive.org/web/20150523054953/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:036/?name=MDVSA-2015:036
generic_textual MODERATE https://web.archive.org/web/20150523054953/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:036/?name=MDVSA-2015:036
cvssv3.1 7.5 https://web.archive.org/web/20151104201446/http://secunia.com/advisories/62718
generic_textual MODERATE https://web.archive.org/web/20151104201446/http://secunia.com/advisories/62718
cvssv3.1 7.5 https://www.djangoproject.com/weblog/2015/jan/13/security
generic_textual MODERATE https://www.djangoproject.com/weblog/2015/jan/13/security
generic_textual Medium https://www.djangoproject.com/weblog/2015/jan/13/security/
cvssv3.1 7.5 http://ubuntu.com/usn/usn-2469-1
generic_textual MODERATE http://ubuntu.com/usn/usn-2469-1
cvssv3.1 6.1 http://www.mandriva.com/security/advisories?name=MDVSA-2015:109
generic_textual MODERATE http://www.mandriva.com/security/advisories?name=MDVSA-2015:109
Reference id Reference type URL
http://advisories.mageia.org/MGASA-2015-0026.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-0220.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-0220.json
https://api.first.org/data/v1/epss?cve=CVE-2015-0220
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0219
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0220
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0221
http://secunia.com/advisories/62285
http://secunia.com/advisories/62309
http://secunia.com/advisories/62718
https://github.com/django/django
https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.18.txt#L34-L46
https://github.com/django/django/commit/4c241f1b710da6419d9dca160e80b23b82db7758
https://github.com/django/django/commit/72e0b033662faa11bb7f516f18a132728aa0ae28
https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-5.yaml
https://ubuntu.com/security/notices/USN-2469-1
https://web.archive.org/web/20150128111656/http://secunia.com/advisories/62285
https://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109
https://web.archive.org/web/20150523054953/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:036/?name=MDVSA-2015:036
https://web.archive.org/web/20151104201446/http://secunia.com/advisories/62718
https://www.djangoproject.com/weblog/2015/jan/13/security
https://www.djangoproject.com/weblog/2015/jan/13/security/
http://ubuntu.com/usn/usn-2469-1
http://www.mandriva.com/security/advisories?name=MDVSA-2015:036
http://www.mandriva.com/security/advisories?name=MDVSA-2015:109
1179675 https://bugzilla.redhat.com/show_bug.cgi?id=1179675
775375 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775375
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.5:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.6:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.7:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.8:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.8:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.6.9:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.6.9:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.7:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.7.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.7.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:1.7.2:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:lts:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:10.04:*:lts:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:lts:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:12.04:*:lts:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
CVE-2015-0220 https://nvd.nist.gov/vuln/detail/CVE-2015-0220
GHSA-gv98-g628-m9x5 https://github.com/advisories/GHSA-gv98-g628-m9x5
USN-2469-1 https://usn.ubuntu.com/2469-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://advisories.mageia.org/MGASA-2015-0026.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.18.txt#L34-L46
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/4c241f1b710da6419d9dca160e80b23b82db7758
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/72e0b033662faa11bb7f516f18a132728aa0ae28
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-5.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2015-0220
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://web.archive.org/web/20150128111656/http://secunia.com/advisories/62285
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://web.archive.org/web/20150523054953/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:036/?name=MDVSA-2015:036
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://web.archive.org/web/20151104201446/http://secunia.com/advisories/62718
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.djangoproject.com/weblog/2015/jan/13/security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://ubuntu.com/usn/usn-2469-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://www.mandriva.com/security/advisories?name=MDVSA-2015:109
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.81045
EPSS Score 0.00724
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.