Improper input validation in Djangoproject Django

CVE-2012-4520

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.036 (88.4th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

References