Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2011-0697 | First vendor Publication | 2011-02-14 |
| Vendor | Cve | Last vendor Modification | 2011-03-11 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0697 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12419 | |||
| Oval ID: | oval:org.mitre.oval:def:12419 | ||
| Title: | DSA-2163-1 python-django -- multiple | ||
| Description: | Several vulnerabilities were discovered in the django web development framework: CVE-2011-0696 For several reasons the internal CSRF protection was not used to validate ajax requests in the past. However, it was discovered that this exception can be exploited with a combination of browser plugins and redirects and thus is not sufficient. CVE-2011-0697 It was discovered that the file upload form is prone to cross-site scripting attacks via the file name. It is important to note that this update introduces minor backward incompatibilities due to the fixes for the above issues. Packages in the oldstable distribution are not affected by these problems. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2163-1 CVE-2011-0696 CVE-2011-0697 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | python-django |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:12682 | |||
| Oval ID: | oval:org.mitre.oval:def:12682 | ||
| Title: | DSA-2163-2 dajaxice -- multiple | ||
| Description: | The changes in python-django DSA-2163 necessary to fix the issues CVE-2011-0696 and CVE-2011-0697 introduced an unavoidable backward incompatibility, which caused a regression in dajaxice, which depends on python-django. This update supplies fixed packages for dajaxice. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2163-2 CVE-2011-0696 CVE-2011-0697 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | dajaxice |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:13659 | |||
| Oval ID: | oval:org.mitre.oval:def:13659 | ||
| Title: | USN-1066-1 -- python-django vulnerabilities | ||
| Description: | It was discovered that Django did not properly validate HTTP requests that contain an X-Requested-With header. An attacker could exploit this vulnerability to perform cross-site request forgery attacks. It was discovered that Django did not properly sanitize its input when performing file uploads, resulting in cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1066-1 CVE-2011-0696 CVE-2011-0697 | Version: | 5 |
| Platform(s): | Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 | Product(s): | python-django |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-09-30 | Name : Fedora Update for Django FEDORA-2011-12481 File : nvt/gb_fedora_2011_12481_Django_fc14.nasl |
| 2011-09-12 | Name : Fedora Update for audacious-plugins FEDORA-2011-12350 File : nvt/gb_fedora_2011_12350_audacious-plugins_fc15.nasl |
| 2011-03-09 | Name : Debian Security Advisory DSA 2163-2 (dajaxice) File : nvt/deb_2163_2.nasl |
| 2011-03-07 | Name : Debian Security Advisory DSA 2163-1 (python-django) File : nvt/deb_2163_1.nasl |
| 2011-02-22 | Name : Fedora Update for Django FEDORA-2011-1235 File : nvt/gb_fedora_2011_1235_Django_fc14.nasl |
| 2011-02-22 | Name : Fedora Update for Django FEDORA-2011-1261 File : nvt/gb_fedora_2011_1261_Django_fc13.nasl |
| 2011-02-22 | Name : Mandriva Update for python-django MDVSA-2011:031 (python-django) File : nvt/gb_mandriva_MDVSA_2011_031.nasl |
| 2011-02-18 | Name : Ubuntu Update for python-django vulnerabilities USN-1066-1 File : nvt/gb_ubuntu_USN_1066_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 71000 | Django File Upload Field Filename XSS Django contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the filename of uploaded files upon submission to the 'file' field. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-02-20 | Name : The remote Fedora host is missing a security update. File : fedora_2011-1235.nasl - Type : ACT_GATHER_INFO |
| 2011-02-20 | Name : The remote Fedora host is missing a security update. File : fedora_2011-1261.nasl - Type : ACT_GATHER_INFO |
| 2011-02-20 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2011-031.nasl - Type : ACT_GATHER_INFO |
| 2011-02-18 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1066-1.nasl - Type : ACT_GATHER_INFO |
| 2011-02-15 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2163.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:13:59 |
|
| 2021-04-22 01:15:09 |
|
| 2020-05-23 00:27:47 |
|
| 2016-04-26 20:32:44 |
|
| 2014-02-17 11:00:27 |
|
| 2013-05-10 22:54:31 |
|
