PT-2014-3648
CVE-2014-0480
·
تاريخ النشر
2014-08-26
·
تاريخ التحديث
2022-05-14
الوصف من
CVSS 4.0
8.7
عاليةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Django versions 1.4.x through 1.4.13
Django versions 1.5.x through 1.5.8
Django versions 1.6.x through 1.6.5
Django versions 1.7 before release candidate 3
Description
The issue allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated. This occurs due to improper validation of URLs by the
core.urlresolvers.reverse function.Recommendations
For Django versions 1.4.x through 1.4.13, update to version 1.4.14 or later.
For Django versions 1.5.x through 1.5.8, update to version 1.5.9 or later.
For Django versions 1.6.x through 1.6.5, update to version 1.6.6 or later.
For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾