CVE-2012-4520: djangoproject django Improper Input Validation

EPSS trend

Probability

3.67%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

0.00 pp

From 3.67% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.67%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

32 links

www.openwall.com/lists/oss-security/2012/10/30/4Mailing ListX Refsource MLISTWEB
securitytracker.com/id?1027708VDB EntryX Refsource SECTRACKWEB
github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071X Refsource CONFIRMWEBFIX
www.osvdb.org/86493VDB EntryX Refsource OSVDBWEB
secunia.com/advisories/51314Third Party AdvisoryX Refsource SECUNIAVendor AdvisoryAdvisory
bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145X Refsource MISCWEB
lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.htmlVendor AdvisoryX Refsource FEDORAWEB
ubuntu.com/usn/usn-1757-1Vendor AdvisoryX Refsource UBUNTUWEB
github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3X Refsource CONFIRMWEBFIX
www.debian.org/security/2013/dsa-2634Vendor AdvisoryX Refsource DEBIANWEBAdvisory

Show all 32 references

www.djangoproject.com/weblog/2012/oct/17/security/X Refsource CONFIRMPatchVendor AdvisoryARTICLE
lists.fedoraproject.org/pipermail/package-announce/2012-October/090904.htmlVendor AdvisoryX Refsource FEDORAWEB
github.com/django/django/commit/9305c0e12d43c4df999c3301a1f0c742264a657eX Refsource CONFIRMWEBFIX
secunia.com/advisories/51033Third Party AdvisoryX Refsource SECUNIAVendor AdvisoryAdvisory
bugzilla.redhat.com/show_bug.cgi?id=865164X Refsource MISCWEBREPORT
lists.fedoraproject.org/pipermail/package-announce/2012-October/090666.htmlVendor AdvisoryX Refsource FEDORAWEB
ubuntu.com/usn/usn-1632-1Vendor AdvisoryX Refsource UBUNTUWEB
nvd.nist.gov/vuln/detail/CVE-2012-4520Advisory
www.openwall.com/lists/oss-security/2012/10/30/4WEB
www.djangoproject.com/weblog/2012/oct/17/securityWEB
www.debian.org/security/2013/dsa-2634WEB
web.archive.org/web/20140417023920/http://securitytracker.com/id?1027708WEB
ubuntu.com/usn/usn-1757-1WEB
ubuntu.com/usn/usn-1632-1WEB
lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.htmlWEB
lists.fedoraproject.org/pipermail/package-announce/2012-October/090904.htmlWEB
lists.fedoraproject.org/pipermail/package-announce/2012-October/090666.htmlWEB
github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2012-7.yamlWEB
github.com/django/djangoPACKAGE
bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145WEB
github.com/advisories/GHSA-2655-q453-22f9Advisory
security-tracker.debian.org/tracker/CVE-2012-4520Advisory

Related vulnerabilities

CVE-2018-16984djangoprojectdjango+12.05%8y ago02-10-2018 18:00An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.CVE-2018-14574alpinepy-django+1225.49%8y ago03-08-2018 17:00django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.CVE-2018-7537alpinepy-django+74.37%8y ago09-03-2018 20:00An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.CVE-2018-7536alpinepy-django+114.55%8y ago09-03-2018 00:00An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.CVE-2018-6188alpinepy-django+54.84%8y ago05-02-2018 03:00django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.CVE-2013-0306canonicalubuntu_linux+32.60%13y ago02-05-2013 14:00The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.

All vulnerabilities indjango

CVE-2012-4520: djangoproject django Improper Input Validation

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References