The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
History
21 Nov 2024, 02:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html - Third Party Advisory | |
| References | () http://secunia.com/advisories/61281 - | |
| References | () http://ubuntu.com/usn/usn-2212-1 - Third Party Advisory | |
| References | () http://www.debian.org/security/2014/dsa-2934 - Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2014/05/14/10 - Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2014/05/15/3 - Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/67410 - Third Party Advisory, VDB Entry | |
| References | () https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/ - Patch, Vendor Advisory |
Information
Published : 2014-05-16 15:55
Updated : 2024-11-21 02:08
NVD link : CVE-2014-3730
Mitre link : CVE-2014-3730
CVE.ORG link : CVE-2014-3730
JSON object : View
Products Affected
canonical
- ubuntu_linux
djangoproject
- django
debian
- debian_linux
opensuse
- opensuse
CWE
CWE-20
Improper Input Validation