{"id":"CVE-2016-2512","aliases":["DEBIAN-CVE-2016-2512","DSA-3544-1","EUVD-2016-0004","GHSA-pw27-w7w4-9qc7","MGASA-2016-0096","PYSEC-2016-15","RHSA-2016:0502","RHSA-2016:0503","RHSA-2016:0504","RHSA-2016:0505","RHSA-2016:0506","SUSE-SU-2018:1102-1","SUSE-SU-2018:1828-1","SUSE-SU-2018:1830-1","UBUNTU-CVE-2016-2512","USN-2915-1","openSUSE-SU-2024:10361-1"],"status":"published","title":"Django XSS Vulnerability","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","severity":{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04053,"percentile":0.90717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-03-01T17:00:00Z","modified":"2026-10-20T10:47:29Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.8.10","1.9.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.9.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.12"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9a1"},{"fixed":"1.9.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u16"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u10","1.4.5-1+deb7u11","1.4.5-1+deb7u11~bpo60+1","1.4.5-1+deb7u12","1.4.5-1+deb7u13","1.4.5-1+deb7u13~bpo60+1","1.4.5-1+deb7u14","1.4.5-1+deb7u14~bpo60+1","1.4.5-1+deb7u15","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7","1.4.5-1+deb7u7~bpo60+1","1.4.5-1+deb7u8","1.4.5-1+deb7u8~bpo60+1","1.4.5-1+deb7u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-1+deb8u4"}]}],"versions":["1.7.7-1","1.7.7-1+deb8u1","1.7.7-1+deb8u2","1.7.7-1+deb8u3"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9a1"},{"fixed":"1.9.3"}]}],"versions":["1.9","1.9.1","1.9.2","1.9a1","1.9b1","1.9rc1","1.9rc2"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"c5544d289233f501917e25970c03ed444abbd4f0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10"},{"introduced":"1.9"},{"fixed":"1.9.3"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1","1.9","1.9.1","1.9.2","1.7a2","1.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el6ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el6ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el6ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack-optools:7::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack-optools:7::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.11-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.11-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.11-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-5.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-5.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-6.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.12"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.12"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-1.1"}]}],"bundled":2}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-0506.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.securitytracker.com/id/1035152","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/83879","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0504.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3544","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0502.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-2915-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2915-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0505.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-2915-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2016/mar/01/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","tags":["x_refsource_CONFIRM","x_transferred","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2512","tags":["advisory"]},{"url":"https://web.archive.org/web/20210123090815/http://www.securityfocus.com/bid/83879","tags":["web"]},{"url":"https://web.archive.org/web/20210413200202/http://www.securitytracker.com/id/1035152","tags":["web"]},{"url":"https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350","tags":["web"]},{"url":"https://github.com/django/django/commit/fc6d147a63f89795dbcdecb0559256470fff4380","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2016/mar/01/security-releases","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-15.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pw27-w7w4-9qc7","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2512","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0096.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17860","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2915-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0502","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311438","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0502.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2512","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2512","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2513","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2513","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2513","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0503","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0503.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0504","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0504.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0505","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0505.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0506.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181102-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001374","tags":["report"]},{"url":"https://bugzilla.suse.com/1008047","tags":["report"]},{"url":"https://bugzilla.suse.com/1008050","tags":["report"]},{"url":"https://bugzilla.suse.com/1031450","tags":["report"]},{"url":"https://bugzilla.suse.com/1031451","tags":["report"]},{"url":"https://bugzilla.suse.com/1056284","tags":["report"]},{"url":"https://bugzilla.suse.com/1083304","tags":["report"]},{"url":"https://bugzilla.suse.com/1083305","tags":["report"]},{"url":"https://bugzilla.suse.com/967999","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181828-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181830-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2512","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2915-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2513","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2513","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2512","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","status":"published","published":"2016-04-08T15:00:00Z","modified":"2024-08-05T23:32:20.686Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2016-0004","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","status":"published","published":"2016-04-08T15:00:00Z","modified":"2024-08-05T23:32:20Z","updated_at":"2026-11-03T02:22:53.17975Z"}],"ghsa":[{"id":"GHSA-pw27-w7w4-9qc7","title":"Django XSS Vulnerability","description":"The `utils.http.is_safe_url function` in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by `http://mysite.example.com\\@attacker.com`.","status":"published","published":"2022-05-17T01:09:58Z","modified":"2024-09-18T16:21:08Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","level":"medium"},{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2016-2512","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","status":"published","published":"2016-04-08T15:59:06.183Z","modified":"2026-06-17T00:44:11.93Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"CVE-2016-2512","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","status":"published","published":"2016-04-08T15:59:06.183Z","modified":"2026-10-20T10:47:29.191164268Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2512","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","status":"published","published":"2016-04-08T15:59:06.183Z","modified":"2026-09-22T07:01:51.281081068Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-pw27-w7w4-9qc7","title":"Django XSS Vulnerability","description":"The `utils.http.is_safe_url function` in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by `http://mysite.example.com\\@attacker.com`.","status":"published","published":"2022-05-17T01:09:58Z","modified":"2024-09-18T16:26:00.186578Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2016-2512","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","status":"published","published":"2016-03-01T17:00:00Z","modified":"2026-02-04T03:26:14.223809Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DSA-3544-1","title":"python-django - security update","status":"published","published":"2016-04-07T00:00:00Z","modified":"2026-03-09T02:10:02.331781Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0096","title":"Updated python-django packages fix security vulnerability","description":"Mark Striemer discovered that Django incorrectly handled user-supplied\nredirect URLs containing basic authentication credentials. A remote\nattacker could possibly use this issue to perform a cross-site scripting\nattack or a malicious redirect. (CVE-2016-2512)\n\nSjoerd Job Postmus discovered that Django incorrectly handled timing when\ndoing password hashing operations. A remote attacker could possibly use\nthis issue to perform user enumeration. (CVE-2016-2513)\n","status":"published","published":"2016-03-07T11:20:30Z","modified":"2026-04-16T06:23:23.906549639Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10361-1","title":"python3-Django-1.10.4-1.1 on GA media","description":"These are all security issues fixed in the python3-Django-1.10.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:00:25.484609Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"PYSEC-2016-15","description":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","status":"published","published":"2016-04-08T15:59:00Z","modified":"2026-06-10T17:01:00.604685674Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2016:0502","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:24Z","modified":"2026-06-29T10:11:59Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0503","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:40Z","modified":"2026-06-29T10:12:00Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0504","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:34Z","modified":"2026-06-29T10:12:01Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0505","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:29Z","modified":"2026-06-29T10:12:01Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0506","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T11:31:48Z","modified":"2026-06-29T10:12:02Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2018:1102-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)\n- CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)\n- CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)\n- CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)\n- CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)\n- CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)\n- CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)\n- CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)\n- CVE-2016-2512: Vulnerability in the function tils.http.is_safe_url could allow remote users to arbitrary \n                 web site and conduct phishing attacks. (bsc#bnc#967999)\n","status":"published","published":"2018-04-27T13:24:32Z","modified":"2026-02-04T03:51:17.509539Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1828-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following security issues:\n\n- CVE-2016-2512: The utils.http.is_safe_url function allowed remote attackers\n  to redirect users to arbitrary web sites and conduct phishing attacks or\n  possibly conduct cross-site scripting (XSS) attacks via a URL containing basic\n  authentication (bsc#967999).\n- CVE-2018-7536: The django.utils.html.urlize() function was extremely slow to\n  evaluate certain inputs due to catastrophic backtracking vulnerabilities\n  (bsc#1083304)\n- CVE-2018-7537: If django.utils.text.Truncator's chars() and words() methods\n  were passed the html=True argument, they were extremely slow to evaluate\n  certain inputs due to a catastrophic backtracking vulnerability in a regular\n  expression (bsc#1083305)\n","status":"published","published":"2018-06-27T11:36:38Z","modified":"2026-02-04T02:58:17.365432Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1830-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following security issues:\n\n- CVE-2016-2512: The utils.http.is_safe_url function allowed remote attackers\n  to redirect users to arbitrary web sites and conduct phishing attacks or\n  possibly conduct cross-site scripting (XSS) attacks via a URL containing basic\n  authentication (bsc#967999).\n- CVE-2018-7536: The django.utils.html.urlize() function was extremely slow to\n  evaluate certain inputs due to catastrophic backtracking vulnerabilities\n  (bsc#1083304).\n- CVE-2018-7537: If django.utils.text.Truncator's chars() and words() methods\n  were passed the html=True argument, they were extremely slow to evaluate\n  certain inputs due to a catastrophic backtracking vulnerability in a regular\n  expression (bsc#1083305).\n","status":"published","published":"2018-06-27T13:35:42Z","modified":"2026-02-04T03:10:05.744115Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-2915-1","title":"python-django vulnerabilities","description":"Mark Striemer discovered that Django incorrectly handled user-supplied\nredirect URLs containing basic authentication credentials. A remote\nattacker could possibly use this issue to perform a cross-site scripting\nattack or a malicious redirect. (CVE-2016-2512)\n\nSjoerd Job Postmus discovered that Django incorrectly handled timing when\ndoing password hashing operations. A remote attacker could possibly use\nthis issue to perform user enumeration. (CVE-2016-2513)\n","status":"published","published":"2016-03-01T18:35:12Z","modified":"2026-02-10T04:40:57Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}