GHSA-vq3h-3q7v-9prw

Suggest an improvement
Source
https://github.com/advisories/GHSA-vq3h-3q7v-9prw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vq3h-3q7v-9prw/GHSA-vq3h-3q7v-9prw.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vq3h-3q7v-9prw
Aliases
Published
2022-05-14T02:09:43Z
Modified
2024-09-18T19:45:57.550789Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Django Allows Open Redirects
Details

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Database specific
{
    "nvd_published_at": "2014-05-16T15:55:00Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-15T22:09:31Z"
}
References

Affected packages

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.4
Fixed
1.4.13

Affected versions

1.*

1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10
1.4.11
1.4.12

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.5
Fixed
1.5.8

Affected versions

1.*

1.5
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.6
Fixed
1.6.5

Affected versions

1.*

1.6
1.6.1
1.6.2
1.6.3
1.6.4

Ecosystem specific

{
    "affected_functions": [
        "django.utils.http.is_safe_url"
    ]
}

PyPI / django

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.7a1
Fixed
1.7b4