{"id":"CVE-2012-4520","published":"2012-11-18T23:00:00Z","modified":"2024-08-06T20:42:53Z","title":"The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03665,"percentile":0.89643,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2012/10/30/4","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://securitytracker.com/id?1027708","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071","tags":["x_refsource_CONFIRM"]},{"url":"http://www.osvdb.org/86493","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://secunia.com/advisories/51314","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145","tags":["x_refsource_MISC"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://ubuntu.com/usn/usn-1757-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3","tags":["x_refsource_CONFIRM"]},{"url":"http://www.debian.org/security/2013/dsa-2634","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.djangoproject.com/weblog/2012/oct/17/security/","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090904.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://github.com/django/django/commit/9305c0e12d43c4df999c3301a1f0c742264a657e","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/51033","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=865164","tags":["x_refsource_MISC"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090666.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://ubuntu.com/usn/usn-1632-1","tags":["vendor-advisory","x_refsource_UBUNTU"]}],"priority":{"score":17.9,"factors":[{"name":"EPSS percentile","points":17.93}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.3, <1.3.4",">=1.4, <1.4.2"],"patched":["1.3.4","1.4.2"],"from":["GHSA-2655-q453-22f9","PYSEC-2012-7"],"provenance":"source"}],"euvd":{"id":"EUVD-2012-0006","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2012-3442","parents":[{"from":"CVE-2012-3442","to":"CVE-2012-4520","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.3.2","toFixed":"1.3.4","daysApart":110},{"kind":"same-code","provenance":"machine","files":["django/http/__init__.py"],"commits":["https://github.com/django/django/commit/e34685034b60be1112160e76091e5aee60149fa1","https://github.com/django/django/commit/4dea4883e6c50d75f215a6b9bcbd95273f57c72d","https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3","https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2012-4520","to":"CVE-2014-1418","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/http/__init__.py"],"commits":["https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3","https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071","https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769","https://github.com/django/django/commit/28e23306aa53bbbb8fb87db85f99d970b051026c"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2012-3442","published":"2012-07-31","fixed":"1.4.1","kev":false},{"cve":"CVE-2012-3443","published":"2012-07-31","fixed":"1.4.1","kev":false},{"cve":"CVE-2012-3444","published":"2012-07-31","fixed":"1.4.1","kev":false},{"cve":"CVE-2012-4520","published":"2012-11-18","fixed":"1.4.2","kev":false},{"cve":"CVE-2013-0305","published":"2013-05-02","fixed":"1.4.4","kev":false},{"cve":"CVE-2013-0306","published":"2013-05-02","fixed":"1.4.4","kev":false},{"cve":"CVE-2013-1664","published":"2013-04-03","fixed":"1.4.4","kev":false}],"package":"PyPI:Django"}}