CVE-2017-12794
MEDIUM 5.3EPSS 23.6%
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
- CVSS v4.0 GitHub
- 5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS v3.0 NVD
- 6.1 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 23.57% chance of exploitation in the next 30 days, 98th percentile
- Nuclei
- medium · CWE-79
- Published
- 2017-09-07
- Updated
- 2024-08-05
Nuclei templates (1)
Vulhub environments (1)
Exploit collections (1)
- （CVE-2017-12794）Django debug page XSS漏洞helloexp/0day
Security advisories
- https://www.djangoproject.com/weblog/2017/sep/05/security-releases
- http://www.securityfocus.com/bid/100643
- http://www.securitytracker.com/id/1039264
- advisories/GHSA-9r8w-6x8c-6jr9
- https://usn.ubuntu.com/3559-1