Read the docs
TI-2017-04918 Aliases CVE-2017-7233GHSA-37hp-765x-j95x

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input…

Priority LOW 32CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 8 fixed, 8 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

Why it matters now

EPSS 0.02404 84th percentileScored 2026-11-07
Fix Partial Django (PyPI): 1.10.7, 1.9.13, 1.8.18Red Hat: 7 advisoriesRed Hat: 8 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Django (PyPI)1.10a1 to before 1.10.71.10.7Patch availableGHSA-37hp-765x-j95x
—Django (PyPI)1.9a1 to before 1.9.131.9.13Patch availableGHSA-37hp-765x-j95x
—Django (PyPI)1.8a1 to before 1.8.181.8.18Patch availableGHSA-37hp-765x-j95x
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Django (PyPI) Vendor— Affected 1.10a1 to before 1.10.7 Fixed in 1.10.7 Patch available GHSA-37hp-765x-j95x
  • Django (PyPI) Vendor— Affected 1.9a1 to before 1.9.13 Fixed in 1.9.13 Patch available GHSA-37hp-765x-j95x
  • Django (PyPI) Vendor— Affected 1.8a1 to before 1.8.18 Fixed in 1.8.18 Patch available GHSA-37hp-765x-j95x

CPE configurations NVD · 49

CPEVersionsRoleVendor
cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*1.8.0Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.0:a1:*:*:*:*:*:*1.8.0 a1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.0:b1:*:*:*:*:*:*1.8.0 b1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.0:b2:*:*:*:*:*:*1.8.0 b2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.0:c1:*:*:*:*:*:*1.8.0 c1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*1.8.1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*1.8.2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*1.8.3Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*1.8.4Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*1.8.5Vulnerabledjangoproject
  • cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.0:a1:*:*:*:*:*:* Versions 1.8.0 a1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.0:b1:*:*:*:*:*:* Versions 1.8.0 b1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.0:b2:*:*:*:*:*:* Versions 1.8.0 b2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.0:c1:*:*:*:*:*:* Versions 1.8.0 c1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·djangoproject
Show 39 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*1.8.6Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:*1.8.7Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:*1.8.8Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*1.8.9Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:*1.8.10Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:*1.8.11Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:*1.8.12Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:*1.8.13Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:*1.8.14Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:*1.8.15Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.16:*:*:*:*:*:*:*1.8.16Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.8.17:*:*:*:*:*:*:*1.8.17Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*1.9Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9:a1:*:*:*:*:*:*1.9 a1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9:b1:*:*:*:*:*:*1.9 b1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9:rc1:*:*:*:*:*:*1.9 rc1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9:rc2:*:*:*:*:*:*1.9 rc2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*1.9.1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*1.9.2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*1.9.3Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*1.9.4Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*1.9.5Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*1.9.6Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*1.9.7Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*1.9.8Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*1.9.9Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:*1.9.10Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.11:*:*:*:*:*:*:*1.9.11Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.9.12:*:*:*:*:*:*:*1.9.12Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:*1.10.0Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.0:a1:*:*:*:*:*:*1.10.0 a1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.0:b1:*:*:*:*:*:*1.10.0 b1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.0:rc1:*:*:*:*:*:*1.10.0 rc1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*1.10.1Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*1.10.2Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.3:*:*:*:*:*:*:*1.10.3Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.4:*:*:*:*:*:*:*1.10.4Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.5:*:*:*:*:*:*:*1.10.5Vulnerabledjangoproject
cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:*1.10.6Vulnerabledjangoproject
  • cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:* Versions 1.8.6 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:* Versions 1.8.7 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:* Versions 1.8.8 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:* Versions 1.8.9 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:* Versions 1.8.10 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:* Versions 1.8.11 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:* Versions 1.8.12 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:* Versions 1.8.13 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:* Versions 1.8.14 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:* Versions 1.8.15 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.16:*:*:*:*:*:*:* Versions 1.8.16 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.8.17:*:*:*:*:*:*:* Versions 1.8.17 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9:a1:*:*:*:*:*:* Versions 1.9 a1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9:b1:*:*:*:*:*:* Versions 1.9 b1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9:rc1:*:*:*:*:*:* Versions 1.9 rc1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9:rc2:*:*:*:*:*:* Versions 1.9 rc2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:* Versions 1.9.4 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:* Versions 1.9.6 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:* Versions 1.9.7 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:* Versions 1.9.8 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:* Versions 1.9.9 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:* Versions 1.9.10 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.11:*:*:*:*:*:*:* Versions 1.9.11 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.9.12:*:*:*:*:*:*:* Versions 1.9.12 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.0:a1:*:*:*:*:*:* Versions 1.10.0 a1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.0:b1:*:*:*:*:*:* Versions 1.10.0 b1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.0:rc1:*:*:*:*:*:* Versions 1.10.0 rc1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:* Versions 1.10.1 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:* Versions 1.10.2 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.3:*:*:*:*:*:*:* Versions 1.10.3 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.4:*:*:*:*:*:*:* Versions 1.10.4 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.5:*:*:*:*:*:*:* Versions 1.10.5 Vulnerable ·djangoproject
  • cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:* Versions 1.10.6 Vulnerable ·djangoproject

Remediation

  • Fix · GHSA-37hp-765x-j95x Django (PyPI) Fixed in 1.10.7 Advisory →
  • Fix · GHSA-37hp-765x-j95x Django (PyPI) Fixed in 1.9.13 Advisory →
  • Fix · GHSA-37hp-765x-j95x Django (PyPI) Fixed in 1.8.18 Advisory →

Red Hat 7 advisories

  • RHSA-2018:2927 Released 2018-10-16 · Red Hat rating Important
    Satellite 6.4 security, bug fix, and enhancement update
    • Red Hat Satellite 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, candlepin-2.4.8-1.el7 +47
    • Red Hat Satellite Capsule 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
  • RHSA-2017:3093 Released 2017-10-31 · Red Hat rating Moderate
    python-django security update
    • Red Hat OpenStack Platform 11.0 python-django-1.8.18-1.el7ost, python-django-bash-completion-1.8.18-1.el7ost
  • RHSA-2017:1596 Released 2017-06-28 · Red Hat rating Moderate
    python-django security update
    • Red Hat OpenStack Platform 10.0 python-django-1.8.18-1.el7ost, python-django-bash-completion-1.8.18-1.el7ost
Show 4 more Red Hat advisories
  • RHSA-2017:1470 Released 2017-06-14 · Red Hat rating Moderate
    python-django security update
    • Red Hat OpenStack Platform 8.0 (Liberty) python-django-1.8.18-1.el7ost, python-django-bash-completion-1.8.18-1.el7ost
  • RHSA-2017:1445 Released 2017-06-14 · Red Hat rating Moderate
    python-django security update
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 python-django-1.6.11-7.el7ost, python-django-bash-completion-1.6.11-7.el7ost, python-django-doc-1.6.11-7.el7ost
  • RHSA-2017:1451 Released 2017-06-14 · Red Hat rating Moderate
    python-django security update
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 python-django-1.8.18-1.el7ost, python-django-bash-completion-1.8.18-1.el7ost, python-django-doc-1.8.18-1.el7ost
  • RHSA-2017:1462 Released 2017-06-14 · Red Hat rating Moderate
    python-django security update
    • Red Hat OpenStack Platform 9.0 python-django-1.8.18-1.el7ost, python-django-bash-completion-1.8.18-1.el7ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 1.3AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational ToolsAffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 8 (Liberty) Operational ToolsAffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka) Operational ToolsAffectedNo fix planned: Will not fix
Red Hat Storage Console 2AffectedNo fix planned: Will not fix
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2017:1445
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2017:1451
Red Hat OpenStack Platform 10.0Fixed RHSA-2017:1596
Red Hat OpenStack Platform 11.0Fixed RHSA-2017:3093
Red Hat OpenStack Platform 8.0 (Liberty)Fixed RHSA-2017:1470
Red Hat OpenStack Platform 9.0Fixed RHSA-2017:1462
Red Hat Satellite 6.4Fixed RHSA-2018:2927
Red Hat Satellite Capsule 6.4Fixed RHSA-2018:2927
Not affected: 2 products
  • Red Hat OpenStack Platform 10 (Newton) Operational Tools
  • Red Hat OpenStack Platform 12 (Pike)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7233
  2. 2026-10-03 Alias added: GHSA-37hp-765x-j95x

References

Advisory 11

Other 6

  • TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
  • TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
  • TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
  • TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
  • TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
  • TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
See all 156 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences