CVE-2014-0480

Published: Aug 26, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Affected (42)

Products: Opensuse: Opensuse · Djangoproject: Django

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 12.3
Opensuse Opensuse	Version 13.1

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.7 beta1
Djangoproject Django	Version 1.7 beta2
Djangoproject Django	Version 1.7 beta3
Djangoproject Django	Version 1.7 beta4
Djangoproject Django	Version 1.7 rc1
Djangoproject Django	Version 1.7 rc2

Configuration C

10 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.6.1
Djangoproject Django	Version 1.6.2
Djangoproject Django	Version 1.6.3
Djangoproject Django	Version 1.6.4
Djangoproject Django	Version 1.6.5
Djangoproject Django	Version 1.6
Djangoproject Django	Version 1.6 beta1
Djangoproject Django	Version 1.6 beta2
Djangoproject Django	Version 1.6 beta3
Djangoproject Django	Version 1.6 beta4

Configuration D

11 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Version 1.5.1
Djangoproject Django	Version 1.5.2
Djangoproject Django	Version 1.5.3
Djangoproject Django	Version 1.5.4
Djangoproject Django	Version 1.5.5
Djangoproject Django	Version 1.5.6
Djangoproject Django	Version 1.5.7
Djangoproject Django	Version 1.5.8
Djangoproject Django	Version 1.5
Djangoproject Django	Version 1.5 alpha
Djangoproject Django	Version 1.5 beta

Configuration E

13 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	version ≤ 1.4.13
Djangoproject Django	Version 1.4.10
Djangoproject Django	Version 1.4.11
Djangoproject Django	Version 1.4.12
Djangoproject Django	Version 1.4.1
Djangoproject Django	Version 1.4.2
Djangoproject Django	Version 1.4.4
Djangoproject Django	Version 1.4.5
Djangoproject Django	Version 1.4.6
Djangoproject Django	Version 1.4.7
Djangoproject Django	Version 1.4.8
Djangoproject Django	Version 1.4.9
Djangoproject Django	Version 1.4