{"action":"Upgrade django to 1.8.18 or later.","affected":[{"fixed":"1.8.18","introduced":"1.8"},{"fixed":"1.9.13","introduced":"1.9"},{"fixed":"1.10.7","introduced":"1.10"}],"component":"django","cve_ids":["CVE-2017-7234"],"ecosystem":"PyPI","epss":0.01845,"exploited":false,"fixed_versions":["1.10.7","1.9.13","1.8.18"],"ghsa_id":"GHSA-h4hv-m4h4-mhwg","id":"tcs_01M5KG6ZSTGMA7YCBHH9M72DVH","modified_at":"2023-11-08T03:59:24.075955Z","published_at":"2017-04-04T17:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-10","https://www.djangoproject.com/weblog/2017/apr/04/security-releases/","http://www.securityfocus.com/bid/97401","http://www.securitytracker.com/id/1038177","http://www.debian.org/security/2017/dsa-3835","https://github.com/advisories/GHSA-h4hv-m4h4-mhwg"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-10","url":"https://osv.dev/vulnerability/PYSEC-2017-10"}],"summary":"A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open"}