VULNERABILITY INTELLIGENCE

CVE-2014-3730

CVSS score4.3 NONE
EPSS probability3.15%
CISA KEVNot currently listed
Published2014-05-16
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N

Description

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."

Weakness classification

  • nvd@nist.gov: CWE-20

Primary references