{"id":"CVE-2011-4138","published":"2011-10-19T10:00:00Z","modified":"2024-08-07T00:01:51Z","title":"The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1…","vendor":null,"product":null,"tier":"tail","description":{"text":"The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0236,"percentile":0.83778,"provenance":"source"},"cwes":[],"references":[{"url":"https://hermes.opensuse.org/messages/14700881","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.debian.org/security/2011/dsa-2332","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=737366","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/46614","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://openwall.com/lists/oss-security/2011/09/11/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.djangoproject.com/weblog/2011/sep/10/127/","tags":["x_refsource_CONFIRM"]},{"url":"http://openwall.com/lists/oss-security/2011/09/13/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.djangoproject.com/weblog/2011/sep/09/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.8,"factors":[{"name":"EPSS percentile","points":16.76}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":["<1.2.7",">=1.3, <1.3.1"],"patched":["1.2.7","1.3.1"],"from":["GHSA-wxg3-mfph-qg9w","PYSEC-2011-3"],"provenance":"source"}],"euvd":{"id":"EUVD-2011-0008","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2011-4137","children":[{"from":"CVE-2011-4138","to":"CVE-2014-0474","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/db/models/fields/__init__.py"],"commits":["https://github.com/django/django/commit/1a76dbefdfc60e2d5954c0ba614c3d054ba9c3f0","https://github.com/django/django/commit/7268f8af86186518821d775c530d5558fd726930","https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292","https://github.com/django/django/commit/985434fb1d6bf2335bf96c6ebf91c3674f1f399f"],"basis":"rarely changed file"}]}]}}