CVE-2014-0480
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
- opensuse:opensuse
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f7cm-ccfp-3q4r | PyPI | django | <1.4.14 | 1.4.14 |
| GHSA-f7cm-ccfp-3q4r | PyPI | django | >=1.5 <1.5.9 | 1.5.9 |
| GHSA-f7cm-ccfp-3q4r | PyPI | django | >=1.6 <1.6.6 | 1.6.6 |
| PYSEC-2014-4 | PyPI | django | <1.4.14 >=1.5 <1.5.9 >=1.6 <1.6.6 | 1.4.14, 1.5.9, 1.6.6 |