Description

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."

Remediation

References

CVE-2014-3730

Related Vulnerabilities

Plone CMS Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2012-5500)

Rukovoditel Improper Input Validation Vulnerability (CVE-2020-11819)

WordPress Plugin Safe Redirect Manager SQL Injection (1.7.7)

Chamilo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-34187)

WordPress Plugin Livemesh Addons for Elementor Multiple Cross-Site Scripting Vulnerabilities (6.7.1)

Severity

Medium

Classification

CVE-2014-3730 CWE-20

Tags

Missing Update Known Vulnerabilities