CVE-2014-3730 — Improper Input Validation in Django

CWE-20 — Improper Input Validation8 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
1.0%
top 23.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Djangoproject DjangoCanonical Ubuntu LinuxDebian Linux+1 more
Timeline
PublishedMay 16
Latest updateMay 14

Description

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶PyPIdjangoproject/django1.4 — 1.4.13+3
▶NVDdjangoproject/django26 versions+25
▶NVDopensuse/opensuse12.3, 13.1+1

Also affects: Debian Linux 7.0, 8.0, Ubuntu Linux 10.04, 12.04, 12.10, 13.10, 14.04

Patches

Patch: www.djangoproject.com ↗Patch: www.djangoproject.com ↗

🔴Vulnerability Details

4
GHSA
Django Allows Open Redirects↗2022-05-14
▶
OSV
Django Allows Open Redirects↗2022-05-14
▶
CVEList
CVE-2014-3730: The django↗2014-05-16
▶
OSV
CVE-2014-3730: The django↗2014-05-16
▶

📋Vendor Advisories

2
Red Hat
Django: insufficient URL validation could lead to redirects↗2014-05-14
▶
Debian
CVE-2014-3730: python-django - The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 befor...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-3730 Django: insufficient URL validation could lead to redirects↗2014-05-14
▶
CVE-2014-3730 — Improper Input Validation in Django | cvebase