{"id":"CVE-2016-2512","published":"2016-04-08T15:00:00Z","modified":"2024-08-05T23:32:20Z","title":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect…","vendor":null,"product":null,"tier":"tail","description":{"text":"The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04053,"percentile":0.90608,"provenance":"source"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-0506.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1035152","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securityfocus.com/bid/83879","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0504.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.debian.org/security/2016/dsa-3544","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0502.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.ubuntu.com/usn/USN-2915-3","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-2915-2","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0505.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.ubuntu.com/usn/USN-2915-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://www.djangoproject.com/weblog/2016/mar/01/security-releases/","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.1,"factors":[{"name":"EPSS percentile","points":18.12}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":["<1.8.10",">=1.9a1, <1.9.3",">=1.9, <1.9.3"],"patched":["1.8.10","1.9.3"],"from":["GHSA-pw27-w7w4-9qc7","PYSEC-2016-15"],"provenance":"source"}],"euvd":{"id":"EUVD-2016-0004","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2014-3730","parents":[{"from":"CVE-2014-3730","to":"CVE-2016-2512","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3","https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df","https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350"],"basis":"shared function","functions":["is_safe_url"]},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same package + description similarity"}]},{"from":"CVE-2015-2317","to":"CVE-2016-2512","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b","https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1","https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350"],"basis":"shared function","functions":["is_safe_url"]},{"kind":"similar","provenance":"machine","score":0.47,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2016-2512","to":"CVE-2017-7233","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350","https://github.com/django/django/commit/254326cb3682389f55f886804d2c43f7b9f23e4f","https://github.com/django/django/commit/8339277518c7d8ec280070a780915304654e3b66"],"basis":"shared function","functions":["is_safe_url"]}]}],"packageHistory":[{"cve":"CVE-2015-5963","published":"2015-08-24","fixed":"1.8.4","kev":false},{"cve":"CVE-2015-8213","published":"2015-12-07","fixed":"1.9rc2","kev":false,"link":{"from":"CVE-2015-8213","to":"CVE-2016-2512","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.8.7","toFixed":"1.8.10","daysApart":123}]}},{"cve":"CVE-2016-2048","published":"2016-02-08","fixed":"1.9.2","kev":false,"link":{"from":"CVE-2016-2048","to":"CVE-2016-2512","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.9.2","toFixed":"1.9.3","daysApart":60}]}},{"cve":"CVE-2016-2512","published":"2016-04-08","fixed":"1.9.3","kev":false},{"cve":"CVE-2016-2513","published":"2016-04-08","fixed":"1.9.3","kev":false},{"cve":"CVE-2016-7401","published":"2016-10-03","fixed":"1.9.10","kev":false},{"cve":"CVE-2016-6186","published":"2016-08-05","fixed":"1.10rc1","kev":false,"link":{"from":"CVE-2016-2512","to":"CVE-2016-6186","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.8.10","toFixed":"1.8.14","daysApart":119}]}}],"package":"PyPI:Django"}}