Skip to content
Fencer Intel
medium 6.1

CVE-2017-7233 json

Django open redirect and possible XSS attack via user-supplied numeric redirect URLs

published 2017-04-04 9 y ago modified 2026-06-17 4 mo ago also GHSA-37hp-765x-j95x , PYSEC-2017-9 , EUVD-2017-0026

cvss
6.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

Patch / fix

  • pypi django 1.8.18, 1.9.13, 1.10.7
  • python-django Debian 14, Debian 13, Debian 12 1:1.10.7-1

debian advisories DEBIAN-CVE-2017-7233

  • python-django Ubuntu 14.04 LTS 1.6.11-0ubuntu1.1
  • python-django Ubuntu 16.04 LTS 1.8.7-1ubuntu5.5

ubuntu advisories UBUNTU-CVE-2017-7233

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • v8 satellite capsule 6.4 1:3.14.5.10-19.el7sat
  • tfm satellite capsule 6.4, satellite 6.4 4.0-3.el7sat
  • kobo satellite capsule 6.4, satellite 6.4 0.5.1-1.el7sat
  • pulp satellite capsule 6.4, satellite 6.4 2.16.4.1-1.el7sat
  • gofer satellite capsule 6.4, satellite 6.4 2.12.1-1.el7sat
  • ostree satellite capsule 6.4, satellite 6.4 2017.1-2.atomic.el7
  • SOAPpy satellite capsule 6.4, satellite 6.4 0.11.6-17.el7
  • foreman satellite capsule 6.4, satellite 6.4 1.18.0.37-1.el7sat

red hat advisories RHSA-2018:2927RHSA-2017:3093RHSA-2017:1445RHSA-2017:1596RHSA-2017:1462RHSA-2017:1470

  • python-Django OpenStack Cloud 6 1.8.19-3.6.1
  • python-Django OpenStack Cloud 7 1.8.19-3.4.1

suse advisories SUSE-SU-2018:1102-1SUSE-SU-2018:0973-1

  • python-Django5 openSUSE Tumbleweed 5.2.16-1.1
  • python-Django openSUSE Tumbleweed 5.2.16-1.1
  • python-Django4 openSUSE Tumbleweed 4.2.30-4.1
  • python-Django6 openSUSE Tumbleweed 6.0-1.1
  • python-Django4 openSUSE Tumbleweed 4.2.14-1.1
  • python-Django openSUSE Tumbleweed 3.2.7-2.3
  • python-Django openSUSE Tumbleweed 4.2.11-2.1
  • python-Django Package Hub 12 SP1 1.11.15-2.1

opensuse advisories openSUSE-SU-2026:11270-1openSUSE-SU-2026:11248-1openSUSE-SU-2026:11235-1openSUSE-SU-2026:10005-1openSUSE-SU-2024:14208-1openSUSE-SU-2024:11205-1

  • py-django Alpine 3.10, Alpine 3.9, Alpine 3.8 +2 more 1.10.7-r0
  • py-django Alpine 3.5, Alpine 3.4, Alpine 3.3 +1 more 1.8.18-r0
  • py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.10.7-r0

alpine advisories ALPINE-CVE-2017-7233

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-django Arch Linux 1.11-1

arch linux advisories AVG-233

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7233 updated cvss 6.1

python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs

  • Red Hat Ceph Storage 1.3 calamari-server Red Hat Ceph Storage 2 python-django, python-django-bash-completion Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) python-django Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools python-django, python-django-bash-completion Red Hat OpenStack Platform 8 (Liberty) Operational Tools python-django, python-django-bash-completion Red Hat OpenStack Platform 9 (Mitaka) Operational Tools python-django, python-django-bash-completion
    +2 more products
    Red Hat Storage Console 2 Django, python-django Red Hat Subscription Asset Manager Django
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 python-django 1.6.11-7.el7ost, python-django-bash-completion 1.6.11-7.el7ost
    fixed: vendor fix RHSA-2017:1445
  • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 python-django 1.8.18-1.el7ost, python-django-bash-completion 1.8.18-1.el7ost
    fixed: vendor fix RHSA-2017:1451
  • Red Hat OpenStack Platform 8.0 (Liberty) python-django 1.8.18-1.el7ost, python-django-bash-completion 1.8.18-1.el7ost
    fixed: vendor fix RHSA-2017:1470
  • Red Hat OpenStack Platform 9.0 python-django 1.8.18-1.el7ost, python-django-bash-completion 1.8.18-1.el7ost
    fixed: vendor fix RHSA-2017:1462
  • Red Hat OpenStack Platform 10.0 python-django 1.8.18-1.el7ost, python-django-bash-completion 1.8.18-1.el7ost
    fixed: vendor fix RHSA-2017:1596
  • Red Hat OpenStack Platform 11.0 python-django 1.8.18-1.el7ost, python-django-bash-completion 1.8.18-1.el7ost
    fixed: vendor fix RHSA-2017:3093
  • Red Hat Satellite 6.4 tfm 4.0-3.el7sat, kobo 0.5.1-1.el7sat, SOAPpy 0.11.6-17.el7, candlepin 2.4.8-1.el7, gofer 2.12.1-1.el7sat, liquibase 3.1.0-1.el7, +383 more Red Hat Satellite Capsule 6.4 tfm 4.0-3.el7sat, kobo 0.5.1-1.el7sat, SOAPpy 0.11.6-17.el7, gofer 2.12.1-1.el7sat, katello 3.7.0-8.el7sat, pulp 2.16.4.1-1.el7sat, +217 more
    fixed: vendor fix RHSA-2018:2927
show 1 more
  • Red Hat OpenStack Platform 10 (Newton) Operational Tools python-django, python-django-bash-completion Red Hat OpenStack Platform 12 (Pike) python-django, python-django-bash-completion
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.40% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi django
>=1.10a1, <1.10.7
>=1.9a1, <1.9.13
>=1.8a1, <1.8.18
>=1.10, <1.10.7
>=1.9, <1.9.13
>=1.8, <1.8.18
1.10.7
1.9.13
1.8.18

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.