CVE-2011-4138

The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD…

published October 19, 2011

CVSS
—
EPSS
2%
Percentile
83.5
In the wild
Unconfirmed
What it is

The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02360 · 83.5th percentile
Published
2011-10-19T10:00Z
EPSS history
Timeline
  • 19 OCT 10:00Z
    The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD…
    cvelistv5