CVE-2014-3730

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate…

published May 16, 2014

CVSS
—
EPSS
3%
Percentile
87.8
In the wild
Unconfirmed
What it is

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03149 · 87.8th percentile
Published
2014-05-16T15:00Z
EPSS history
Timeline
  • 16 MAY 15:00Z
    The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate…
    cvelistv5