CVE-2011-0697

Published: Feb 14, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.

Affected (9)

Products: Djangoproject: Django

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.1.0
Djangoproject Django	Version 1.1.2
Djangoproject Django	Version 1.1.3
Djangoproject Django	Version 1.1

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.2.1
Djangoproject Django	Version 1.2.2
Djangoproject Django	Version 1.2.3
Djangoproject Django	Version 1.2.4
Djangoproject Django	Version 1.2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (36)

http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054207.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054208.html

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/02/09/6

Source: secalert@redhat.com

Patch

http://secunia.com/advisories/43230

Source: secalert@redhat.com

http://secunia.com/advisories/43297

Source: secalert@redhat.com

http://secunia.com/advisories/43382

Source: secalert@redhat.com

http://secunia.com/advisories/43426

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2163

Source: secalert@redhat.com

http://www.djangoproject.com/weblog/2011/feb/08/security/

Source: secalert@redhat.com

PatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:031

Source: secalert@redhat.com

http://www.securityfocus.com/bid/46296

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1066-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0372

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0388

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0429

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0439

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0441

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=676359

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054207.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054208.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/02/09/6

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/43230

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43297

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43382

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43426

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2163

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.djangoproject.com/weblog/2011/feb/08/security/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:031

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/46296

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1066-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0372

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0388

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0429

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0439

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0441

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=676359

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.