5.2.4. Framework

5.2.4.1. Django

5.2.4.1.1. Historical Vulnerabilities

• CVE-2016-7401 CSRF Bypass

• CVE-2017-7233/7234 Open redirect vulnerability

• CVE-2017-12794 debug page XSS

5.2.4.1.2. Configuration related

• When Nginx is a reverse proxy for Django, misconfiguration of the static file directory will lead to source code leakage. Visiting /static.. will 301 redirect to /static../

5.2.4.2. Flask

Flask uses client-side sessions by default, so that sessions can be forged