CVE-2016-2512

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-2512
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2512.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-2512
Aliases
Downstream
Related
Published
2016-04-08T15:59:06.183Z
Modified
2026-04-24T09:24:58.713479Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The utils.http.issafeurl function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type
GIT
Repo
https://github.com/django/django
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c982190acf7bcfba5e78a7505a45774916865569
Last affected
3df8ccf6fc3fa0ab2acf9a03da43fea87f8ff392
Last affected
e70a309c428cfd4e600dc9fa0c7269b1e7a8efcd
Last affected
c00335997744196738368f46c30ef2eeaa0ac849
Database specific 
{
    "cpe": [
        "cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.9"
        },
        {
            "last_affected": "1.9"
        },
        {
            "last_affected": "1.9.1"
        },
        {
            "last_affected": "1.9.2"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

1.*
1.0
1.1
1.2
1.2.1
1.3
1.4
1.7a2
1.8
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.8a1
1.8b1
1.8b2
1.8c1
1.9
1.9.1
1.9.10
1.9.11
1.9.12
1.9.13
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
1.9a1
1.9b1
1.9rc1
1.9rc2
stable/1.*
stable/1.9.x

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2512.json"