Description
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.
References (7)
Core 7
Core References
Patch, Vendor Advisory x_refsource_confirm
https://www.djangoproject.com/weblog/2014/aug/20/security/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/69425
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/61276
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/61281
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2014/dsa-3010
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59782
Scores
EPSS
0.0228
EPSS Percentile
81.1%
Details
CWE
CWE-20
Status
published
Products (32)
djangoproject/django
1.7 beta1 (6 CPE variants)
djangoproject/django
1.6 (5 CPE variants)
djangoproject/django
1.6.1
djangoproject/django
1.6.2
djangoproject/django
1.6.3
djangoproject/django
1.6.4
djangoproject/django
1.6.5
djangoproject/django
1.5 (3 CPE variants)
djangoproject/django
1.5.1
djangoproject/django
1.5.2
... and 22 more
Published
Aug 26, 2014
Tracked Since
Feb 18, 2026