logo

Database

Lack of data validation In django

Description

Django Incorrectly Validates URLs The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2014-04802. NVD-2014-04803. OSV-2014-04804. OSV-DEBIAN-2014-04805. GCVE-2014-04806. SECURITY-TRACKER-CVE-2014-0480

References

1. https://github.com/django/django/commit/45ac9d4fb087d21902469fc22643f5201d41a0cd2. https://github.com/django/django/commit/c2fe73133b62a1d9e8f7a6b43966570b14618d7e3. https://github.com/django/django/commit/da051da8df5e69944745072611351d4cfc6435d54. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-4.yaml5. https://web.archive.org/web/20140918034351/http://www.securityfocus.com/bid/694256. https://www.djangoproject.com/weblog/2014/aug/20/security7. http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html8. http://www.debian.org/security/2014/dsa-3010

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.