CVE-2014-0474

Published: Apr 23, 2014Modified: May 6, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."

Affected (28)

Products: Canonical: Ubuntu Linux · Djangoproject: Django

1 product

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10
Canonical Ubuntu Linux	Version 13.10
Canonical Ubuntu Linux	Version 14.04

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.6.1
Djangoproject Django	Version 1.6.2
Djangoproject Django	Version 1.6

Configuration C

11 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Up to 1.4.10
Djangoproject Django	Version 1.4.1
Djangoproject Django	Version 1.4.2
Djangoproject Django	Version 1.4.3
Djangoproject Django	Version 1.4.4
Djangoproject Django	Version 1.4.5
Djangoproject Django	Version 1.4.6
Djangoproject Django	Version 1.4.7
Djangoproject Django	Version 1.4.8
Djangoproject Django	Version 1.4.9
Djangoproject Django	Version 1.4

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.7 alpha1
Djangoproject Django	Version 1.7 alpha2
Djangoproject Django	Version 1.7 beta1

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.5.1
Djangoproject Django	Version 1.5.2
Djangoproject Django	Version 1.5.3
Djangoproject Django	Version 1.5.4
Djangoproject Django	Version 1.5.5
Djangoproject Django	Version 1.5