Description

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Remediation

References

CVE-2012-4520

Related Vulnerabilities

IBM WebSEAL Improper Restriction of XML External Entity Reference Vulnerability (CVE-2019-4707)

Moodle Improper Authentication Vulnerability (CVE-2014-0214)

Drupal Core 9.0.x Remote Code Execution (9.0.0 - 9.0.7)

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-7873)

WordPress Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-0615)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2012-4520