CVE-2014-0480: Input Validation
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.
Other sources
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0480?
CVE-2014-0480 is classified as a high severity vulnerability that allows for phishing attacks due to improper URL validation in Django.
How do I fix CVE-2014-0480?
To fix CVE-2014-0480, upgrade Django to versions 1.4.14, 1.5.9, 1.6.6 or newer.
What versions of Django are affected by CVE-2014-0480?
CVE-2014-0480 affects Django versions before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3.
Can I continue using Django if it has CVE-2014-0480?
It is highly discouraged to continue using Django with CVE-2014-0480 as it exposes your application to phishing risks.
What functions are affected by CVE-2014-0480?
The `core.urlresolvers.reverse` function is affected by CVE-2014-0480, which improperly validates URLs.