Description

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Remediation

References

CVE-2012-4520

Related Vulnerabilities

MySQL CVE-2024-21157 Vulnerability (CVE-2024-21157)

Ruby Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-16255)

WordPress Plugin WP Mobile Detector Cross-Site Scripting (3.2)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-4850)

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker Multiple Vulnerabilities (8.0.8)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2012-4520