CVEvulnerability
CVE-2014-3730
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-05-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
Affected configurations
• canonical ubuntu linux 10.04
• canonical ubuntu linux 12.04
• canonical ubuntu linux 12.10
• canonical ubuntu linux 13.10
• canonical ubuntu linux 14.04
• djangoproject django 1.4
• djangoproject django 1.4.1
• djangoproject django 1.4.2
• djangoproject django 1.4.4
• djangoproject django 1.4.5
• djangoproject django 1.4.6
• djangoproject django 1.4.7
• djangoproject django 1.4.8
• djangoproject django 1.4.9
• djangoproject django 1.4.10
• djangoproject django 1.4.11
• djangoproject django 1.4.12
• djangoproject django 1.7
• opensuse opensuse 12.3
• opensuse opensuse 13.1
• djangoproject django 1.6
• djangoproject django 1.6.1
• djangoproject django 1.6.2
• djangoproject django 1.6.3
• djangoproject django 1.6.4
• debian debian linux 7.0
• debian debian linux 8.0
• djangoproject django 1.5
• djangoproject django 1.5.1
• djangoproject django 1.5.2
• djangoproject django 1.5.3
• djangoproject django 1.5.4
• djangoproject django 1.5.5
• djangoproject django 1.5.6
• djangoproject django 1.5.7
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html Third Party Advisory
- http://secunia.com/advisories/61281 secunia.com
- http://ubuntu.com/usn/usn-2212-1 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2934 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/14/10 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/15/3 Third Party Advisory
- http://www.securityfocus.com/bid/67410 Third Party Advisory, VDB Entry
- https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/ Patch, Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html Third Party Advisory
- http://secunia.com/advisories/61281 secunia.com
- http://ubuntu.com/usn/usn-2212-1 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2934 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/14/10 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/15/3 Third Party Advisory
- http://www.securityfocus.com/bid/67410 Third Party Advisory, VDB Entry
- https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/ Patch, Vendor Advisory