CVE-2014-0472: Code Injection
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.6.3 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.5.6 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.4.11 - Upgrade
Upgrade
djangoto a version that resolves this vulnerability.Fixed in 1.4.11 - Upgrade
Upgrade
djangoto a version that resolves this vulnerability.Fixed in 1.5.6 - Upgrade
Upgrade
djangoto a version that resolves this vulnerability.Fixed in 1.6.3 - Upgrade
Upgrade
djangoto a version that resolves this vulnerability.Fixed in 1.7 beta 2
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0472?
CVE-2014-0472 has a medium-severity rating due to its ability to allow remote attackers to execute arbitrary Python modules.
How do I fix CVE-2014-0472?
To fix CVE-2014-0472, upgrade Django to versions 1.4.11, 1.5.6, 1.6.3, or any later version.
What software is affected by CVE-2014-0472?
CVE-2014-0472 affects Django versions prior to 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7 beta 2.
What are the risks of not addressing CVE-2014-0472?
Not addressing CVE-2014-0472 may expose your applications to remote code execution vulnerabilities, allowing attackers to exploit your systems.
Is CVE-2014-0472 specific to certain operating systems?
CVE-2014-0472 is not limited to specific operating systems but is associated with vulnerable Django versions across platforms.