CVE-2018-14574

Aliases:GHSA-5hg3-6c2f-f3wrPYSEC-2018-2
Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 03 Aug 2018, 17:00
Last modified:05 Aug 2024, 09:29

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.1 MEDIUM
v3.0 (nvd)
EPSS Score
7.48% LOW
7% probability -2.27%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

03 Aug 2018, 17:00
Published
Vulnerability first disclosed
05 Aug 2024, 09:29
Last Modified
Vulnerability information updated

Description

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
  • v3.0•MEDIUM•Score: 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • v2.0•MEDIUM•Score: 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS Trends

Current EPSS score: 7.48%• Percentile: 92%

Techniques & Countermeasures

  • CWE-601•URL Redirection to Untrusted Site ('Open Redirect')

    The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Affected Systems

  • canonical•ubuntu_linux

    18.04

  • debian•debian_linux

    9.0

  • djangoproject•django

    ≥ 1.11, < 1.11.15 | ≥ 2.0, < 2.0.8

  • PyPI•django

    ≥ 2.0, < 2.0.8 | ≥ 1.11, < 1.11.15

References (16)