CVE-2011-4137: djangoproject django Resource Management Errors
Vulnerability summary
CVE-2011-4137 is a medium (CVSS 5.0) Resource Management Errors vulnerability in djangoproject django. EPSS estimates a 3.02% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 19-10-2011PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
3.02%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.02% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python-django< 1.3.1-1
Djangoproject1 product
- djangoEOL≤ 1.2.6 | 0.91 | 0.95 | 0.95.1 | 0.96 | 1.0 | 1.0.1 | 1.0.2 | 1.1 | 1.10 | 1.1.2 | 1.1.3 | 1.2 | 1.2.1 | 1.2.1:2 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.3 | 1.3:alpha1 | 1.3:alpha2
PyPI1 product
- django< 1.2.7 | ≥ 1.3, < 1.3.1
3 vendors · 3 products
References
18 links
Show all 18 references
- github.com/django/djangoPACKAGE
