GitHub Advisoryadvisory · PyPI

GHSA-2655-q453-22f9 Django Allows Arbitrary URL Generation

HIGH Published 2022-05-17 Modified 2024-09-18 Official page ↗
Aliases
CVE-2012-4520
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2023-08-29

Affected packages

• PyPI Django: >= 1.3, < 1.3.4 → fixed in 1.3.4 • PyPI Django: >= 1.4, < 1.4.2 → fixed in 1.4.2

Description

The `django.http.HttpRequest.get_host` function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Related

Alias · CVE (1)

  • CVE-2012-4520 The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References