Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.

Multiple vulnerabilities has been found and corrected in python-django :

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a combination of browser plugins and redirects, a related issue to CVE-2011-0447 (CVE-2011-0696).

Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload (CVE-2011-0697).

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays (CVE-2011-0698).

The updated packages have been upgraded to the 1.1.4 version which is not vulnerable to these issues.

Fix for CVE-2011-0696 and CVE-2011-0697.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Django did not properly validate HTTP requests that contain an X-Requested-With header. An attacker could exploit this vulnerability to perform cross-site request forgery (CSRF) attacks. (CVE-2011-0696)

It was discovered that Django did not properly sanitize its input when performing file uploads, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2011-0697).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Django web development framework :

  - CVE-2011-0696     For several reasons the internal CSRF protection was not     used to validate AJAX requests in the past. However, it     was discovered that this exception can be exploited with     a combination of browser plugins and redirects and thus     is not sufficient.

  - CVE-2011-0697     It was discovered that the file upload form is prone to     cross-site scripting attacks via the file name.

It is important to note that this update introduces minor backward incompatibilities due to the fixes for the above issues. For the exact details, please see: and in particular the 'Backwards incompatible changes' section.

Packages in the oldstable distribution (lenny) are not affected by these problems.

ID	Name	Product	Family	Severity
52036	Mandriva Linux Security Advisory : python-django (MDVSA-2011:031)	Nessus	Mandriva Local Security Checks	high
52034	Fedora 13 : Django-1.2.5-1.fc13 (2011-1261)	Nessus	Fedora Local Security Checks	medium
52033	Fedora 14 : Django-1.2.5-1.fc14 (2011-1235)	Nessus	Fedora Local Security Checks	medium
52022	Ubuntu 9.10 / 10.04 LTS / 10.10 : python-django vulnerabilities (USN-1066-1)	Nessus	Ubuntu Local Security Checks	medium
51979	Debian DSA-2163-1 : python-django - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-0697

medium

Tenable Plugins

high

medium

medium

medium

medium