GitHub Advisoryadvisory · PyPI

GHSA-vq3h-3q7v-9prw Django Allows Open Redirects

HIGH Published 2022-05-14 Modified 2024-09-18 Official page ↗
Aliases
CVE-2014-3730
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2023-08-15

Affected packages

• PyPI Django: >= 1.4, < 1.4.13 → fixed in 1.4.13 • PyPI Django: >= 1.5, < 1.5.8 → fixed in 1.5.8 • PyPI Django: >= 1.6, < 1.6.5 → fixed in 1.6.5 • PyPI Django: >= 1.7a1, < 1.7b4 → fixed in 1.7b4

Description

The `django.util.http.is_safe_url` function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."

Related

Alias · CVE (1)

  • CVE-2014-3730 The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References