CVE-2014-3730

Опубликовано: 16 мая 2014

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Ссылки

http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
Third Party Advisory
http://secunia.com/advisories/61281
http://ubuntu.com/usn/usn-2212-1
Third Party Advisory
http://www.debian.org/security/2014/dsa-2934
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/14/10
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/15/3
Third Party Advisory
http://www.securityfocus.com/bid/67410
Third Party Advisory
VDB Entry
https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/
Patch
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
Third Party Advisory
http://secunia.com/advisories/61281
http://ubuntu.com/usn/usn-2212-1
Third Party Advisory
http://www.debian.org/security/2014/dsa-2934
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/14/10
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/15/3
Third Party Advisory
http://www.securityfocus.com/bid/67410
Third Party Advisory
VDB Entry
https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.6:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.7:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.8:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.9:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.10:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.11:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.4.12:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:djangoproject:django:1.7:beta1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.7:beta2:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.7:beta3:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:djangoproject:django:1.6:-:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.6:beta2:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.6:beta3:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.6:beta4:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.6.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.6.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.6.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.6.4:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 7

Одно из

cpe:2.3:a:djangoproject:django:1.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5:alpha:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5:beta:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5.1:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5.2:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5.3:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5.4:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5.5:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5.6:*:*:*:*:*:*:*

cpe:2.3:a:djangoproject:django:1.5.7:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00988

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2014-3730

ubuntu

больше 11 лет назад

CVE-2014-3730

redhat

больше 11 лет назад

CVE-2014-3730

debian

больше 11 лет назад

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, ...

GHSA-vq3h-3q7v-9prw

CVSS3: 7.5

github

больше 3 лет назад

Django Allows Open Redirects

EPSS

Процентиль: 76%

0.00988

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-20