CVE-2018-14574: Medium severity djangoproject Django vulnerability
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
Other sources
A flaw was found in Django. If the django.middleware.common.CommonMiddleware and the APPENDSLASH setting are both enabled, and if the project has a URL pattern that accepts any path ending in a slash (many content management systems have such a pattern), then a request to a maliciously crafted URL of that site could lead to a redirect to another site, enabling phishing and other attacks.
— Red Hat
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-14574.
What is the severity of CVE-2018-14574?
The severity of CVE-2018-14574 is medium with a CVSS score of 6.1.
Which versions of Django are affected by CVE-2018-14574?
Django versions 1.11.x before 1.11.15 and 2.0.x before 2.0.8 are affected by CVE-2018-14574.
How can I fix the vulnerability CVE-2018-14574?
To fix the vulnerability CVE-2018-14574, upgrade Django to version 1.11.15 or 2.0.8.
Where can I find more information about CVE-2018-14574?
You can find more information about CVE-2018-14574 on the NIST NVD website, Red Hat Errata, and GitHub Advisories.