Improper input validation in Djangoproject Django
CVE-2014-3730
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.031 (86.5th percentile) — read the EPSS interpretation.
Affected products
- Djangoproject Django — versions 1.4, 1.4.1, 1.4.2
- Canonical Ubuntu_linux — versions 10.04, 12.04, 12.10
- Debian Debian_linux — versions 7.0, 8.0
- Opensuse — versions 12.3, 13.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@debian.org (x_refsource_SECUNIA, third-party-advisory)
- security@debian.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- security@debian.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- security@debian.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@debian.org (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- security@debian.org (mailing-list, x_refsource_MLIST, Third Party Advisory)
- security@debian.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security@debian.org (mailing-list, x_refsource_MLIST, Third Party Advisory)
Frequently asked questions
- What is CVE-2014-3730?
- CVE-2014-3730 is a vulnerability in Djangoproject Django, classified under Improper Input Validation. Published 2014-05-16.
- Is CVE-2014-3730 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.