Description
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.
Remediation
References
Related Vulnerabilities
Oracle Application Server Credentials Management Errors Vulnerability (CVE-2002-2345)
WordPress Plugin Simple Schools Staff Directory Arbitrary File Upload (1.1)
Jenkins Improper Restriction of Rendered UI Layers or Frames Vulnerability (CVE-2020-2105)
WordPress Plugin Tickera-WordPress Event Ticketing Unspecified Vulnerability (3.4.6.7)