{"id":"CVE-2014-3730","published":"2014-05-16T15:00:00Z","modified":"2024-08-06T10:50:18Z","title":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7…","vendor":null,"product":null,"tier":"tail","description":{"text":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03149,"percentile":0.87894,"provenance":"source"},"cwes":[],"references":[{"url":"http://secunia.com/advisories/61281","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.debian.org/security/2014/dsa-2934","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://ubuntu.com/usn/usn-2212-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securityfocus.com/bid/67410","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/14/10","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":17.6,"factors":[{"name":"EPSS percentile","points":17.58}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.4, <1.4.13",">=1.5, <1.5.8",">=1.6, <1.6.5",">=1.7a1, <1.7b4",">=1.7a0, <1.7b4"],"patched":["1.4.13","1.5.8","1.6.5","1.7b4"],"from":["GHSA-vq3h-3q7v-9prw","PYSEC-2014-20"],"provenance":"source"}],"euvd":{"id":"EUVD-2014-0010","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2014-3730","children":[{"from":"CVE-2014-3730","to":"CVE-2015-2317","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3","https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df","https://github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b","https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1"],"basis":"shared function","functions":["is_safe_url"]},{"kind":"similar","provenance":"machine","score":0.49,"basis":"same package + description similarity"}]},{"from":"CVE-2014-3730","to":"CVE-2016-2512","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3","https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df","https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0","https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350"],"basis":"shared function","functions":["is_safe_url"]},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same package + description similarity"}]},{"from":"CVE-2014-3730","to":"CVE-2017-7233","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/utils/http.py"],"commits":["https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3","https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df","https://github.com/django/django/commit/254326cb3682389f55f886804d2c43f7b9f23e4f","https://github.com/django/django/commit/8339277518c7d8ec280070a780915304654e3b66"],"basis":"shared function","functions":["is_safe_url"]},{"kind":"similar","provenance":"machine","score":0.35,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2014-0472","published":"2014-04-23","fixed":"1.6.3","kev":false,"link":{"from":"CVE-2014-0472","to":"CVE-2014-3730","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.4.11","toFixed":"1.4.13","daysApart":23}]}},{"cve":"CVE-2014-0480","published":"2014-08-26","fixed":"1.6.6","kev":false},{"cve":"CVE-2014-0481","published":"2014-08-26","fixed":"1.6.6","kev":false},{"cve":"CVE-2014-1418","published":"2014-05-16","fixed":"1.7b4","kev":false},{"cve":"CVE-2014-3730","published":"2014-05-16","fixed":"1.7b4","kev":false},{"cve":"CVE-2014-0482","published":"2014-08-26","fixed":"1.7c3","kev":false},{"cve":"CVE-2014-0483","published":"2014-08-26","fixed":"1.7c3","kev":false},{"cve":"CVE-2015-0219","published":"2015-01-16","fixed":"1.7.3","kev":false}],"package":"PyPI:Django"}}