PT-2014-3648 · Django Software Foundation+1 · Django+1

Florian Apolloner · Published 2014-08-26 · Updated 2022-05-14 · CVE-2014-0480

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.13 Django versions 1.5.x through 1.5.8 Django versions 1.6.x through 1.6.5 Django versions 1.7 before release candidate 3

Description The issue allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated. This occurs due to improper validation of URLs by the core.urlresolvers.reverse function.

Recommendations For Django versions 1.4.x through 1.4.13, update to version 1.4.14 or later. For Django versions 1.5.x through 1.5.8, update to version 1.5.9 or later. For Django versions 1.6.x through 1.6.5, update to version 1.6.6 or later. For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-0480

DLA-65-1

DSA-3010-1

GHSA-F7CM-CCFP-3Q4R

MGASA-2014-0366

PYSEC-2014-4

SUSE-SU-2015:0563-1

SUSE-SU-2015:0695-1

USN-2347-1

Affected Products

Django

Ubuntu

References · 30

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0480 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0480 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2347-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f7cm-ccfp-3q4r · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0480 · Vendor Advisory
• https://djangoproject.com/weblog/2014/aug/20/security · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0366 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0480 · Security Note
• http://debian.org/security/2014/dsa-3010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0481 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2347-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0480 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0366.html · Security Note