PT-2014-3648 · Django Software Foundation+1 · Django+1

Florian Apolloner · Publicado 2014-08-26 · Atualizado 2022-05-14 · CVE-2014-0480

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.13 Django versions 1.5.x through 1.5.8 Django versions 1.6.x through 1.6.5 Django versions 1.7 before release candidate 3

Description The issue allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated. This occurs due to improper validation of URLs by the core.urlresolvers.reverse function.

Recommendations For Django versions 1.4.x through 1.4.13, update to version 1.4.14 or later. For Django versions 1.5.x through 1.5.8, update to version 1.5.9 or later. For Django versions 1.6.x through 1.6.5, update to version 1.6.6 or later. For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-0480

DLA-65-1

DSA-3010-1

GHSA-F7CM-CCFP-3Q4R

MGASA-2014-0366

PYSEC-2014-4

SUSE-SU-2015:0563-1

SUSE-SU-2015:0695-1

USN-2347-1

Produtos afetados

Django

Ubuntu

Referências · 30

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/da051da8df5e69944745072611351d4cfc6435d5 · Nota
• https://github.com/django/django/commit/c2fe73133b62a1d9e8f7a6b43966570b14618d7e · Nota
• https://github.com/django/django/commit/45ac9d4fb087d21902469fc22643f5201d41a0cd · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-4.yaml · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0480 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-0480 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2347-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=13963 · Nota
• https://osv.dev/vulnerability/GHSA-f7cm-ccfp-3q4r · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2014-4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-0480 · Aviso do Fabricante
• https://djangoproject.com/weblog/2014/aug/20/security · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0366 · Aviso do Fabricante