The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
References
| Link | Resource |
|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html | Third Party Advisory |
| http://secunia.com/advisories/61281 | |
| http://ubuntu.com/usn/usn-2212-1 | Third Party Advisory |
| http://www.debian.org/security/2014/dsa-2934 | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2014/05/14/10 | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2014/05/15/3 | Third Party Advisory |
| http://www.securityfocus.com/bid/67410 | Third Party Advisory VDB Entry |
| https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/ | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
History
No history.
Information
Published : 2014-05-16 15:55
Updated : 2018-10-30 16:27
NVD link : CVE-2014-3730
Mitre link : CVE-2014-3730
CVE.ORG link : CVE-2014-3730
JSON object : View
Products Affected
opensuse
- opensuse
djangoproject
- django
canonical
- ubuntu_linux
debian
- debian_linux
CWE
CWE-20
Improper Input Validation