CVE-2014-3730
UnknownEPSS 3.12%
Last modified
CVE-2014-3730 is a vulnerability of currently unknown severity. The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com.". EPSS estimates a 3.12% chance of exploitation in the next 30 days.
Description
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Canonical | Ubuntu Linux | 10.04 | — |
| Canonical | Ubuntu Linux | 12.04 | — |
| Canonical | Ubuntu Linux | 12.10 | — |
| Canonical | Ubuntu Linux | 13.10 | — |
| Canonical | Ubuntu Linux | 14.04 | — |
| Djangoproject | Django | 1.4 | — |
| Djangoproject | Django | 1.4.1 | — |
| Djangoproject | Django | 1.4.2 | — |
| Djangoproject | Django | 1.4.4 | — |
| Djangoproject | Django | 1.4.5 | — |
| Djangoproject | Django | 1.4.6 | — |
| Djangoproject | Django | 1.4.7 | — |
| Djangoproject | Django | 1.4.8 | — |
| Djangoproject | Django | 1.4.9 | — |
| Djangoproject | Django | 1.4.10 | — |
| Djangoproject | Django | 1.4.11 | — |
| Djangoproject | Django | 1.4.12 | — |
| Djangoproject | Django | 1.7 | Beta1 |
| Opensuse | Opensuse | 12.3 | — |
| Opensuse | Opensuse | 13.1 | — |
| Djangoproject | Django | 1.6 | — |
| Djangoproject | Django | 1.6.1 | — |
| Djangoproject | Django | 1.6.2 | — |
| Djangoproject | Django | 1.6.3 | — |
| Djangoproject | Django | 1.6.4 | — |
| Debian | Debian Linux | 7.0 | — |
| Debian | Debian Linux | 8.0 | — |
| Djangoproject | Django | 1.5 | — |
| Djangoproject | Django | 1.5.1 | — |
| Djangoproject | Django | 1.5.2 | — |
| Djangoproject | Django | 1.5.3 | — |
| Djangoproject | Django | 1.5.4 | — |
| Djangoproject | Django | 1.5.5 | — |
| Djangoproject | Django | 1.5.6 | — |
| Djangoproject | Django | 1.5.7 | — |
References
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.htmlThird Party Advisory
- http://ubuntu.com/usn/usn-2212-1Third Party Advisory
- http://www.debian.org/security/2014/dsa-2934Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/14/10Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/15/3Third Party Advisory
- http://www.securityfocus.com/bid/67410Third Party Advisory, VDB Entry
- https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/Patch, Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.htmlThird Party Advisory
- http://ubuntu.com/usn/usn-2212-1Third Party Advisory
- http://www.debian.org/security/2014/dsa-2934Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/14/10Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/15/3Third Party Advisory
- http://www.securityfocus.com/bid/67410Third Party Advisory, VDB Entry
- https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-3730?
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
How severe is CVE-2014-3730?
Severity scoring for CVE-2014-3730 is pending analysis. The EPSS model estimates a 3.12% probability of exploitation in the next 30 days.
How do I fix CVE-2014-3730?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-3714The ARM image loading functionality in Xen 4.4.x does not pr…
- CVE-2014-3715Buffer overflow in Xen 4.4.x allows local users to read syst…
- CVE-2014-3716Xen 4.4.x does not properly check alignment, which allows lo…
- CVE-2014-3717Xen 4.4.x does not properly validate the load address for 64…
- CVE-2014-3718Multiple cross-site scripting (XSS) vulnerabilities in cgi-b…6.1
- CVE-2014-3719Multiple SQL injection vulnerabilities in cgi-bin/review_m.c…9.8
- CVE-2014-3735ir41_32.ax 4.51.16.3 for Intel Indeo Video 4.5 allows remote…
- CVE-2014-3737Cross-site scripting (XSS) vulnerability in templates/defaul…
- CVE-2014-3738Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 all…
- CVE-2014-3739Open redirect vulnerability in zport/acl_users/cookieAuthHel…
- CVE-2014-3740Cross-site scripting (XSS) vulnerability in SpiceWorks befor…
- CVE-2014-3741The printDirect function in lib/printer.js in the node-print…
Are you affected by CVE-2014-3730?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST