CVE-2014-3730: Input Validation
The django.util.http.issafeurl function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
Other sources
The django.util.http.issafeurl function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3730?
CVE-2014-3730 has been rated as a medium severity vulnerability due to its potential to facilitate open redirect attacks.
How do I fix CVE-2014-3730?
To fix CVE-2014-3730, upgrade Django to version 1.4.13, 1.5.8, 1.6.5, or 1.7b4 or later.
Which versions of Django are affected by CVE-2014-3730?
Django versions 1.4 to 1.4.12, 1.5 to 1.5.7, 1.6 to 1.6.4, and 1.7 beta versions prior to 1.7b4 are affected by CVE-2014-3730.
What type of attack does CVE-2014-3730 allow?
CVE-2014-3730 allows attackers to perform open redirect attacks due to improper URL validation.
What systems are impacted by CVE-2014-3730?
CVE-2014-3730 affects Django running on various operating systems, including Ubuntu and Debian, specifically the versions mentioned.