Description

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Remediation

References

CVE-2012-4520

Related Vulnerabilities

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2020-11112)

Jboss EAP Incorrect Authorization Vulnerability (CVE-2019-14843)

Oracle Application Server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2006-0586)

WordPress Plugin Daily Maui Photo Widget Multiple Cross-Site Scripting Vulnerabilities (0.2)

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2015-4852)

Severity

Medium

Classification

CVE-2012-4520 CWE-20

Tags

Missing Update Known Vulnerabilities