CVE-2012-3442

The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.

• CWE-79

• http://www.debian.org/security/2012/dsa-2529Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:143Broken Link
• http://www.openwall.com/lists/oss-security/2012/07/31/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/07/31/2Mailing List, Third Party Advisory
• http://www.ubuntu.com/usn/USN-1560-1Broken Link
• https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/Patch, Vendor Advisory
• http://www.debian.org/security/2012/dsa-2529Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:143Broken Link
• http://www.openwall.com/lists/oss-security/2012/07/31/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/07/31/2Mailing List, Third Party Advisory
• http://www.ubuntu.com/usn/USN-1560-1Broken Link
• https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/Patch, Vendor Advisory

Published

Jul 31, 2012

Last Modified

Jun 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3436OpenTTD 0.6.0 through 1.2.1 does not properly validate reque…
• CVE-2012-3437The Magick_png_malloc function in coders/png.c in ImageMagic…
• CVE-2012-3438The Magick_png_malloc function in coders/png.c in GraphicsMa…
• CVE-2012-3439Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2012-3440A certain Red Hat script for sudo 1.7.2 on Red Hat Enterpris…
• CVE-2012-3441The database creation script (module/idoutils/db/scripts/cre…
• CVE-2012-3443The django.forms.ImageField class in the form system in Djan…
• CVE-2012-3444The get_image_dimensions function in the image-handling func…
• CVE-2012-3445The virTypedParameterArrayClear function in libvirt 0.9.13 d…
• CVE-2012-3446Apache Libcloud before 0.11.1 uses an incorrect regular expr…5.9
• CVE-2012-3447virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before…
• CVE-2012-3448Unspecified vulnerability in Ganglia Web before 3.5.1 allows…