Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2014-3730 |
CWE-ID | CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Django Web applications / CMS |
Vendor | Django Software Foundation |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU32537
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2014-3730
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\djangoproject.com."
MitigationInstall update from vendor's website.
Vulnerable software versionsDjango: 1.1.4 - 1.4.12
External linkshttp://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
http://secunia.com/advisories/61281
http://ubuntu.com/usn/usn-2212-1
http://www.debian.org/security/2014/dsa-2934
http://www.openwall.com/lists/oss-security/2014/05/14/10
http://www.openwall.com/lists/oss-security/2014/05/15/3
http://www.securityfocus.com/bid/67410
http://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.