Every CVESearch/Get API key

CVE-2015-0220

Django Cross-site Scripting Vulnerability

4.3 MediumFix available

CVE-2015-0220 is a medium vulnerability (CVSS 4.3) in Djangoproject Django, published September 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.04%, the 87th percentile. Fixed in django 1.4.18.

What does this mean?
Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
3.04%EPSS, 87th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.4.18django +15 more

Description

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Exploit likelihood

3.04%Up 1.1 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django
PyPI
before 1.4.18
1.4.18
django
PyPI
1.6 up to 1.6.10
1.6.10
django
PyPI
1.7 up to 1.7.3
1.7.3
python-django
Debian:12
before 1.7.1-1.1
1.7.1-1.1
python-django
Debian:13
before 1.7.1-1.1
1.7.1-1.1
python-django
Debian:14
before 1.7.1-1.1
1.7.1-1.1
python-django
Debian:6.0
From an advisory covering 3 CVEs
before 1.2.3-3+squeeze12, plus listed versions
1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze101.2.3-3+squeeze111.2.3-3+squeeze2
Show 6 moreShow less
1.2.3-3+squeeze31.2.3-3+squeeze51.2.3-3+squeeze61.2.3-3+squeeze71.2.3-3+squeeze81.2.3-3+squeeze9
1.2.3-3+squeeze12
python-django
Debian:7
From an advisory covering 3 CVEs
before 1.4.5-1+deb7u9, plus listed versions
1.4.5-11.4.5-1+deb7u11.4.5-1+deb7u21.4.5-1+deb7u31.4.5-1+deb7u4
Show 7 moreShow less
1.4.5-1+deb7u4~bpo60+11.4.5-1+deb7u51.4.5-1+deb7u61.4.5-1+deb7u71.4.5-1+deb7u7~bpo60+11.4.5-1+deb7u81.4.5-1+deb7u8~bpo60+1
1.4.5-1+deb7u9
django
PyPI
before 1.4.18, plus listed versions
1.0.11.0.21.0.31.0.41.1
Show 38 moreShow less
1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.9
1.4.18
django
PyPI
1.6 up to 1.6.10, plus listed versions
1.6.11.6.21.6.31.6.41.6.5
Show 4 moreShow less
1.6.61.6.71.6.81.6.9
1.6.10
Show 6 moreShow less
Affected packages
PackageAffectedFixed
django
PyPI
1.7 up to 1.7.3, plus listed versions
1.7.11.7.2
1.7.3
python-django14
Mageia:4
From an advisory covering 4 CVEs
before 1.4.18-1.1.mga4
1.4.18-1.1.mga4
python-django
Mageia:4
From an advisory covering 4 CVEs
before 1.5.9-1.1.mga4
1.5.9-1.1.mga4
django
PyPI
before 1.4.18, 1.5 up to 1.6.10, 1.7 up to 1.7.3, plus listed versions
1.0.11.0.21.0.31.0.41.1
Show 45 moreShow less
1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.11.5.101.5.111.5.121.5.21.5.31.5.4
1.4.181.6.101.7.3
python-django
Ubuntu:14.04:LTS
before 1.6.1-2ubuntu0.6, plus listed versions
1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.1
Show 4 moreShow less
1.6.1-2ubuntu0.21.6.1-2ubuntu0.31.6.1-2ubuntu0.41.6.1-2ubuntu0.5
1.6.1-2ubuntu0.6
python-django
Ubuntu:14.04:LTS
From an advisory covering 4 CVEs
before 1.6.1-2ubuntu0.6, plus listed versions
1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.1
Show 4 moreShow less
1.6.1-2ubuntu0.21.6.1-2ubuntu0.31.6.1-2ubuntu0.41.6.1-2ubuntu0.5
1.6.1-2ubuntu0.6

What each source reports

NVD Score used4.3

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Record
CVE-2015-0220
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE ListNo score

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Record
CVE-2015-0220
Updated
2026-11-02
EUVDEUVD-2015-0014No score

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Record
EUVD-2015-0014
Updated
2026-11-03
GitHub AdvisoriesGHSA-gv98-g628-m9x55.3

Django Cross-site Scripting Vulnerability

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a \njavascript: URL.

Record
GHSA-gv98-g628-m9x5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-gv98-g628-m9x55.3

Django Cross-site Scripting Vulnerability

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a \njavascript: URL.

Record
GHSA-gv98-g628-m9x5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVNo score

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Record
CVE-2015-0220
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2015-0220No score

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Record
DEBIAN-CVE-2015-0220
Updated
2026-11-02
OSVMGASA-2015-0026No score

Updated python-django and python-django14 packages fix security vulnerabilities

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments (CVE-2015-0219).

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack (CVE-2015-0220).

Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service (CVE-2015-0221).

Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. Note that this issue only affected python-django (CVE-2015-0222).

Record
MGASA-2015-0026
Updated
2026-11-02
OSVPYSEC-2015-5No score

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Record
PYSEC-2015-5
Updated
2026-11-02
OSVSUSE-SU-2015:0563-1No score

Security update for python-django

python-django was updated to 1.5.10 fixing bugs and security issues:

* Prevented reverse() from generating URLs pointing to other hosts to
  prevent phishing attacks. (bnc#893087, CVE-2014-0480)
* Removed O(n) algorithm when uploading duplicate file names to fix
  file upload denial of service. (bnc#893088, CVE-2014-0481)
* Modified RemoteUserMiddleware to logout on REMOTE_USE change to
  prevent session hijacking. (bnc#893089, CVE-2014-0482)
* Prevented data leakage in contrib.admin via query string
  manipulation. (bnc#893090, CVE-2014-0483)

Security Issues:

* CVE-2014-0480
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480>
* CVE-2014-0481
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481>
* CVE-2014-0482
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482>
* CVE-2014-0483
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483>
Record
SUSE-SU-2015:0563-1
Updated
2026-11-02
OSVSUSE-SU-2015:0695-1No score

Security update for python-django

python-django was updated to 1.5.10 fixing bugs and security issues:

* Prevented reverse() from generating URLs pointing to other hosts to
  prevent phishing attacks. (bnc#893087, CVE-2014-0480)
* Removed O(n) algorithm when uploading duplicate file names to fix
  file upload denial of service. (bnc#893088, CVE-2014-0481)
* Modified RemoteUserMiddleware to logout on REMOTE_USE change to
  prevent session hijacking. (bnc#893089, CVE-2014-0482)
* Prevented data leakage in contrib.admin via query string
  manipulation. (bnc#893090, CVE-2014-0483)

Security Issues:

* CVE-2014-0480
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480>
* CVE-2014-0481
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481>
* CVE-2014-0482
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482>
* CVE-2014-0483
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483>
Record
SUSE-SU-2015:0695-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-0220No score

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

Record
UBUNTU-CVE-2015-0220
Updated
2026-11-02
OSVUSN-2469-1No score

python-django vulnerabilities

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments. (CVE-2015-0219)

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack. (CVE-2015-0220)

Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service. (CVE-2015-0221)

Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0222)

Record
USN-2469-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 48 moreShow less
This page doesn't list everything

Left out here: 17 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open