CVE-2014-0472

Published: Apr 23, 2014Modified: May 6, 2026

5.1

Vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability: 4.9 / Impact: 6.4

Source: NVD

Description

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Affected (28)

Products: Djangoproject: Django · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Up to 1.4.10
Djangoproject Django	Version 1.4.1
Djangoproject Django	Version 1.4.2
Djangoproject Django	Version 1.4.3
Djangoproject Django	Version 1.4.4
Djangoproject Django	Version 1.4.5
Djangoproject Django	Version 1.4.6
Djangoproject Django	Version 1.4.7
Djangoproject Django	Version 1.4.8
Djangoproject Django	Version 1.4.9
Djangoproject Django	Version 1.4

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.6.1
Djangoproject Django	Version 1.6.2
Djangoproject Django	Version 1.6

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.7 alpha1
Djangoproject Django	Version 1.7 alpha2
Djangoproject Django	Version 1.7 beta1

Configuration D

6 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.5.1
Djangoproject Django	Version 1.5.2
Djangoproject Django	Version 1.5.3
Djangoproject Django	Version 1.5.4
Djangoproject Django	Version 1.5.5
Djangoproject Django	Version 1.5

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10
Canonical Ubuntu Linux	Version 13.10
Canonical Ubuntu Linux	Version 14.04