CVE-2013-6044

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.

• CWE-79

• http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
• http://rhn.redhat.com/errata/RHSA-2013-1521.html
• http://seclists.org/oss-sec/2013/q3/369
• http://seclists.org/oss-sec/2013/q3/411
• http://secunia.com/advisories/54476Vendor Advisory
• http://www.debian.org/security/2013/dsa-2740
• http://www.securityfocus.com/bid/61777
• http://www.securitytracker.com/id/1028915
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86437
• https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f
• https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762
• https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a
• https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issuedPatch, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
• http://rhn.redhat.com/errata/RHSA-2013-1521.html
• http://seclists.org/oss-sec/2013/q3/369
• http://seclists.org/oss-sec/2013/q3/411
• http://secunia.com/advisories/54476Vendor Advisory
• http://www.debian.org/security/2013/dsa-2740
• http://www.securityfocus.com/bid/61777
• http://www.securitytracker.com/id/1028915
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86437
• https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f
• https://github.com/django/django/commit/ae3535169af804352517b7fea94a42a1c9c4b762
• https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a
• https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issuedPatch, Vendor Advisory

Published

Oct 4, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6038Stack-based buffer overflow in Trimble SketchUp Viewer 13.0.…
• CVE-2013-6039Multiple cross-site scripting (XSS) vulnerabilities in Nagio…
• CVE-2013-6040MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before …8.1
• CVE-2013-6041index.php in Softaculous Webuzo before 2.1.4 allows remote a…
• CVE-2013-6042Cross-site scripting (XSS) vulnerability in filemanager/logi…
• CVE-2013-6043The login function in Softaculous Webuzo before 2.1.4 provid…
• CVE-2013-6045Multiple heap-based buffer overflows in OpenJPEG 1.3 and ear…
• CVE-2013-6047Multiple cross-site scripting (XSS) vulnerabilities in the s…
• CVE-2013-6048The get_group_tree function in lib/Munin/Master/HTMLConfig.p…
• CVE-2013-6049apt-listbugs before 0.1.10 creates temporary files insecurel…
• CVE-2013-6050Integer overflow in Links before 2.8 allows remote attackers…
• CVE-2013-6051The bgp_attr_unknown function in bgp_attr.c in Quagga 0.99.2…