CVE-2017-7233
Status: ModifiedMedium (6.1)—
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Base score: 6.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.40%
- Percentile among all scored CVEs: 84
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-601
References
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/97406
- http://www.securitytracker.com/id/1038177
- https://access.redhat.com/errata/RHSA-2017:1445
- https://access.redhat.com/errata/RHSA-2017:1451
- https://access.redhat.com/errata/RHSA-2017:1462
- https://access.redhat.com/errata/RHSA-2017:1470
- https://access.redhat.com/errata/RHSA-2017:1596
- https://access.redhat.com/errata/RHSA-2017:3093
- https://access.redhat.com/errata/RHSA-2018:2927
- https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
- http://www.debian.org/security/2017/dsa-3835
- http://www.securityfocus.com/bid/97406
- http://www.securitytracker.com/id/1038177
- https://access.redhat.com/errata/RHSA-2017:1445
- https://access.redhat.com/errata/RHSA-2017:1451
- https://access.redhat.com/errata/RHSA-2017:1462
- https://access.redhat.com/errata/RHSA-2017:1470
- https://access.redhat.com/errata/RHSA-2017:1596
- https://access.redhat.com/errata/RHSA-2017:3093
- https://access.redhat.com/errata/RHSA-2018:2927
- https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
Raw JSON (NVD)
Show
{
"id": "CVE-2017-7233",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-04-04T17:59:00.273",
"references": [
{
"url": "http://www.debian.org/security/2017/dsa-3835",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/97406",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id/1038177",
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1445",
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1451",
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1462",
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1470",
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1596",
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:3093",
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2927",
"source": "cve@mitre.org"
},
{
"url": "https://www.djangoproject.com/weblog/2017/apr/04/security-releases/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2017/dsa-3835",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/97406",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1038177",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1445",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1451",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1462",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1470",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1596",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:3093",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2927",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.djangoproject.com/weblog/2017/apr/04/security-releases/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-601"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an \"on success\" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs \"safe\" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack."
},
{
"lang": "es",
"value": "Django 1.10 en versiones anteriores a 1.10.7, 1.9 en versiones anteriores a 1.9.13, y 1.8 en versiones anteriores a 1.8.18 se basa en la entrada del usuario en algunos casos para redirigir al usuario a una URL de \"éxito\". La comprobación de seguridad de estos redireccionamientos (a saber, `` django.utils.http.is_safe_url()``) considera que algunas URL numéricas son \"seguras\" cuando no deberían serlo, también conocida como una vulnerabilidad de redirección abierta. Además, si un desarrollador confía en `` is_safe_url() `` para proporcionar destinos de redirección seguros y pone esa URL en un enlace, podría sufrir un ataque XSS."
}
],
"lastModified": "2026-06-17T01:23:54.553",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02D3C0FF-C342-40F1-A187-CD212C16FE8F"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.0:a1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85ED1834-500C-4E37-BD51-E42DB28F3B67"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.0:b1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E6E3323E-6AC0-4703-A3A4-A429946B0839"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.0:b2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7AB300FB-2A7D-498E-891D-E75DCA9ED7A5"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.0:c1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1AC1822A-A7FE-4F38-BD5A-74388A5405D5"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2510BAD7-1FB6-4F6F-A2CC-9DE9AD39B4FF"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1B388C7-ED4E-4416-969F-32263E7D7AA8"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "63D36984-4C8E-4CDB-8D15-445705FCECF9"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B324AE6-ADD8-41B9-B250-A6577ACBB364"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6487058-6768-4AD3-BE27-A0B3D1ACFC08"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CFF0538-B111-44A8-ADC2-87E280186257"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3343FF8-53EC-459D-B31C-CD363D04FF42"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9B637E9-067A-4473-9B50-433CCC177982"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99A5BF6D-631B-4C8E-9868-579BD79100C7"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "280B9958-9163-4126-910A-2EF4B408DFCF"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A40373B-301E-4B81-8FA5-28D916142F59"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79BB3174-7859-4195-B7B3-BCAA280A6F80"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42EF41AF-B2FA-468A-B161-D9FE29CE53EB"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "48DF0100-F98E-4997-A8F7-DC07FA4A06D6"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ECDC5647-8EA7-4595-88C2-541BC489ED2D"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB571E66-C1B2-4FFD-8265-FB381CF4ACE6"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C49F25DA-CD52-49A9-B5BE-63FD399A9813"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29C40BAC-6DF3-4EA2-A65A-86462DDD8723"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9:a1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B4797F9-82E9-4BA8-868D-C6F18BA01DE6"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9:b1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E885D945-FB55-47F4-AA6B-462AFBDAD750"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "48BD4296-E83B-4563-9A39-70C95EEAA337"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F63D8C0A-D93E-4A1F-A8F8-D22314771AD4"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B754401-8503-4553-853F-4F6BCD2D2FF2"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "019C26C7-EF1F-45BB-934E-521E2E64452E"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A18691A7-E4D0-48A4-81A7-89846E991AF2"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C06EBD9-381E-4018-BFDC-E23EA18097B0"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D134048-B64F-45AE-B4A2-26E516CCF37B"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F39B83A-C10B-4B88-9491-2FB8B07D6EA5"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64A4030E-F51F-4944-BCE7-E27CD32EC7D4"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CCC1F046-DAF7-4734-9F80-A3C57857AF18"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61EE8536-0E8D-477A-B8EA-817CE21D516A"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "483D0F44-15C8-43A2-B3AE-331F40DA1A80"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD33E383-2772-4F79-A2C9-4F9EB8FBC8EF"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77D82BAD-B2AE-49FB-AF71-393631D2B29C"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D2541CE-0462-46DF-BDD8-C19D6E45140B"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.0:a1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1763E8EB-F943-4A9A-8E19-E6BE9F847DDD"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.0:b1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "48E20213-67BB-4A16-B961-502BA4E54A98"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C71C2E3-C134-45B0-BDDC-FFE7612AB1EF"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CE31960-7C68-42F3-B215-B30A87DB67CC"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3838B8E-8F0E-4F7A-88E6-FFF2590E5302"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D6C6214-7946-4025-84E6-59448CFE75B1"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58182835-CB1F-4490-AE65-90601DBFD0D5"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04AE04CD-E923-4630-9BAA-5A4D5A5D0055"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2517FB1C-B732-432B-9F27-EE60F6556433"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}