CVE-2014-0472
No CVSS score yet. EPSS 5.8% chance of exploitation in the next 30 days. Fixed in django 1.4.11, 1.5.6, 1.6.3.
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."
- EPSS
- 5.8% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rvq6-mrpv-m6rm | PyPI | django | <1.4.11 | 1.4.11 |
| GHSA-rvq6-mrpv-m6rm | PyPI | django | >=1.5 <1.5.6 | 1.5.6 |
| GHSA-rvq6-mrpv-m6rm | PyPI | django | >=1.6 <1.6.3 | 1.6.3 |
| PYSEC-2014-1 | PyPI | django | <1.4.11 >=1.5 <1.5.6 >=1.6 <1.6.3 | 1.4.11, 1.5.6, 1.6.3 |