CVE-2014-0480

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-26 · updated 2026-06-17
Weakness: CWE-20

Description

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Affected products

Django: through 1.4.13; 1.7-beta1, 1.7-beta2, 1.7-beta3, 1.7-beta4, 1.7-rc1, 1.7-rc2 (+33)
Opensuse: 12.3, 13.1

References

http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
http://secunia.com/advisories/59782
http://secunia.com/advisories/61276
http://secunia.com/advisories/61281
http://www.debian.org/security/2014/dsa-3010
http://www.securityfocus.com/bid/69425
https://www.djangoproject.com/weblog/2014/aug/20/security/
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
http://secunia.com/advisories/59782
http://secunia.com/advisories/61276
http://secunia.com/advisories/61281
http://www.debian.org/security/2014/dsa-3010

Get alerted when CVE-2014-0480 or the next vulnerability affects your stack