Published: 09/12/2016 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Django prior to 1.8.x prior to 1.8.16, 1.9.x prior to 1.9.11, and 1.10.x prior to 1.10.3, when settings.DEBUG is True, allow remote malicious users to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject fedora 25
fedoraproject fedora 24
canonical ubuntu linux 16.10
canonical ubuntu linux 12.04
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
djangoproject django 1.8.15
djangoproject django 1.8.2
djangoproject django 1.8.14
djangoproject django 1.8.1
djangoproject django 1.8.7
djangoproject django 1.8.9
djangoproject django 1.8.11
djangoproject django 1.8.3
djangoproject django 1.8.12
djangoproject django 1.8.4
djangoproject django 1.8.6
djangoproject django 1.8
djangoproject django 1.8.13
djangoproject django 1.8.8
djangoproject django 1.8.5
djangoproject django 1.8.10
djangoproject django 1.10
djangoproject django 1.10.1
djangoproject django 1.10.2
djangoproject django 1.9.6
djangoproject django 1.9.9
djangoproject django 1.9.5
djangoproject django 1.9.3
djangoproject django 1.9.4
djangoproject django 1.9.7
djangoproject django 1.9.1
djangoproject django 1.9
djangoproject django 1.9.8
djangoproject django 1.9.2
djangoproject django 1.9.10

Several security issues were fixed in Django ...

Several vulnerabilities were discovered in Django, a high-level Python web development framework The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-9013 Marti Raudsepp reported that a user with a hardcoded password is created when running tests with an Oracle database CVE-2016-9014 Aymeric Au ...

Debian Bug report logs - #859516 python-django: CVE-2017-7234: Open redirect vulnerability in djangoviewsstaticserve() Package: src:python-django; Maintainer for src:python-django is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: ...

Debian Bug report logs - #842856 python-django: CVE-2016-9013 CVE-2016-9014 Package: src:python-django; Maintainer for src:python-django is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 1 Nov 2016 19:39:02 UTC Severity: impo ...

Debian Bug report logs - #859515 python-django: CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs Package: src:python-django; Maintainer for src:python-django is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@deb ...

Django before 18x before 1816, 19x before 1911, and 110x before 1103, when settingsDEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settingsALLOWED_HOSTS ...

Older versions of Django don't validate the Host header against settingsALLOWED_HOSTS when settingsDEBUG=True This makes them vulnerable to a DNS rebinding attack While Django doesn't ship a module that allows remote code execution, this is at least a cross-site scripting vector, which could be quite serious if developers load a copy of the pr ...

CWE-264 http://www.securitytracker.com/id/1037159 http://www.ubuntu.com/usn/USN-3115-1 https://www.djangoproject.com/weblog/2016/nov/01/security-releases/http://www.securityfocus.com/bid/94068 http://www.debian.org/security/2017/dsa-3835 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/https://usn.ubuntu.com/3115-1/https://nvd.nist.gov

CVE-2016-9014

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect