CVE-2017-12794

Published: Sep 7, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.

Affected (13)

Products: Djangoproject: Django

Djangoproject

1 product

Django

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.10.0
Djangoproject Django	Version 1.10.1
Djangoproject Django	Version 1.10.2
Djangoproject Django	Version 1.10.3
Djangoproject Django	Version 1.10.4
Djangoproject Django	Version 1.10.5
Djangoproject Django	Version 1.10.6
Djangoproject Django	Version 1.10.7
Djangoproject Django	Version 1.11.0
Djangoproject Django	Version 1.11.1
Djangoproject Django	Version 1.11.2
Djangoproject Django	Version 1.11.3
Djangoproject Django	Version 1.11.4