CVE-2018-14574: Medium severity djangoproject Django vulnerability
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
Other sources
A flaw was found in Django. If the django.middleware.common.CommonMiddleware and the APPENDSLASH setting are both enabled, and if the project has a URL pattern that accepts any path ending in a slash (many content management systems have such a pattern), then a request to a maliciously crafted URL of that site could lead to a redirect to another site, enabling phishing and other attacks.
— Red Hat
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 2.1 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 2.0.8 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 1.11.15 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 2.0.8 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 1.11.15 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 1.11.15 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.28-1~deb11u2Fixed in 2:2.2.28-1~deb11u12Fixed in 3:3.2.19-1+deb12u1Fixed in 3:3.2.25-0+deb12u1Fixed in 3:4.2.23-1Fixed in 3:4.2.27-0+deb13u1Fixed in 3:4.2.28-1 - Upgrade
Upgrade
alpine/py-djangoto a version that resolves this vulnerability.Fixed in 1.11.15-r0 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 1.11.15-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 1.11.15 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 2.0.8
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-14574.
What is the severity of CVE-2018-14574?
The severity of CVE-2018-14574 is medium with a CVSS score of 6.1.
Which versions of Django are affected by CVE-2018-14574?
Django versions 1.11.x before 1.11.15 and 2.0.x before 2.0.8 are affected by CVE-2018-14574.
How can I fix the vulnerability CVE-2018-14574?
To fix the vulnerability CVE-2018-14574, upgrade Django to version 1.11.15 or 2.0.8.
Where can I find more information about CVE-2018-14574?
You can find more information about CVE-2018-14574 on the NIST NVD website, Red Hat Errata, and GitHub Advisories.