Every CVE Search/ Get API key

CVE-2014-0472

Code Injection in Django

5.1 MediumPublic exploitFix available

CVE-2014-0472 is a medium vulnerability (CVSS 5.1) in Djangoproject Django, published April 22, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.80%, the 93rd percentile. Fixed in django 1.4.11.

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Exploit likelihood

5.80%Down 19.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.1

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
CVE-2014-0472
CVSS 2.0
5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
CVE List No score

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
CVE-2014-0472
Updated
2026-11-02
EUVDEUVD-2014-0007 No score

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
EUVD-2014-0007
Updated
2026-11-03
GitHub AdvisoriesGHSA-rvq6-mrpv-m6rm 9.3

Code Injection in Django

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
GHSA-rvq6-mrpv-m6rm
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-rvq6-mrpv-m6rm 9.3

Code Injection in Django

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
GHSA-rvq6-mrpv-m6rm
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV No score

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
CVE-2014-0472
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2014-0472 No score

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
DEBIAN-CVE-2014-0472
Updated
2026-11-02
OSVMGASA-2014-0196 No score

Updated python-django packages fix multiple vulnerabilities

Updated python-django and python-dgango14 packages fix security vulnerabilities:

Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse() function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulting in possible code execution. (CVE-2014-0472)

Paul McMillan discovered that Django incorrectly cached certain pages that contained CSRF cookies. An attacker could possibly use this flaw to obtain a valid cookie and perform attacks which bypass the CSRF restrictions. (CVE-2014-0473)

Michael Koziarski discovered that Django did not always perform explicit conversion of certain fields when using a MySQL database. An attacker could possibly use this issue to obtain unexpected results. (CVE-2014-0474)

Record
MGASA-2014-0196
Updated
2026-11-02
OSVPYSEC-2014-1 No score

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
PYSEC-2014-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0472 No score

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Record
UBUNTU-CVE-2014-0472
Updated
2026-11-02
OSVUSN-2169-1 No score

python-django vulnerabilities

Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse() function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulting in possible code execution. (CVE-2014-0472)

Paul McMillan discovered that Django incorrectly cached certain pages that contained CSRF cookies. An attacker could possibly use this flaw to obtain a valid cookie and perform attacks which bypass the CSRF restrictions. (CVE-2014-0473)

Michael Koziarski discovered that Django did not always perform explicit conversion of certain fields when using a MySQL database. An attacker could possibly use this issue to obtain unexpected results. (CVE-2014-0474)

Record
USN-2169-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django
PyPI
 before 1.4.11
1.4.11
django
PyPI
 1.5 up to 1.5.6
1.5.6
django
PyPI
 1.6 up to 1.6.3
1.6.3
python-django
Debian:12
 before 1.6.3-1
1.6.3-1
python-django
Debian:13
 before 1.6.3-1
1.6.3-1
python-django
Debian:14
 before 1.6.3-1
1.6.3-1
python-django
Debian:6.0
 before 1.2.3-3+squeeze10, plus listed versions
1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze21.2.3-3+squeeze31.2.3-3+squeeze5
Show 4 moreShow less
1.2.3-3+squeeze61.2.3-3+squeeze71.2.3-3+squeeze81.2.3-3+squeeze9
1.2.3-3+squeeze10
python-django
Debian:7
 before 1.4.5-1+deb7u7, plus listed versions
1.4.5-11.4.5-1+deb7u11.4.5-1+deb7u21.4.5-1+deb7u31.4.5-1+deb7u4
Show 4 moreShow less
1.4.5-1+deb7u4~bpo60+11.4.5-1+deb7u51.4.5-1+deb7u61.4.5-1+deb7u7~bpo60+1
1.4.5-1+deb7u7
django
PyPI
 before 1.4.11, plus listed versions
1.0.11.0.21.0.31.0.41.1
Show 31 moreShow less
1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.9
1.4.11
django
PyPI
 1.5 up to 1.5.6, plus listed versions
1.5.11.5.21.5.31.5.41.5.5
1.5.6
Show 10 moreShow less
Affected packages
PackageAffectedFixed
django
PyPI
 1.6 up to 1.6.3, plus listed versions
1.6.11.6.2
1.6.3
python-django
Mageia:3
 before 1.4.11-1.1.mga3
1.4.11-1.1.mga3
python-django
Mageia:4
 before 1.5.6-1.1.mga4
1.5.6-1.1.mga4
python-django14
Mageia:4
 before 1.4.11-1.1.mga4
1.4.11-1.1.mga4
django
PyPI
 before 1.4.11, 1.5 up to 1.5.6, 1.6 up to 1.6.3, plus listed versions
1.0.11.0.21.0.31.0.41.1
Show 38 moreShow less
1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.11.5.21.5.31.5.41.5.51.6.11.6.2
1.4.111.5.61.6.3
Django14
Red Hat:openstack:4::el6
 before 0:1.4.11-1.el6ost
0:1.4.11-1.el6ost
Django14-doc
Red Hat:openstack:4::el6
 before 0:1.4.11-1.el6ost
0:1.4.11-1.el6ost
Django14
Red Hat:openstack:3::el6
 before 0:1.4.11-1.el6ost
0:1.4.11-1.el6ost
Django14-doc
Red Hat:openstack:3::el6
 before 0:1.4.11-1.el6ost
0:1.4.11-1.el6ost
python-django
Ubuntu:14.04:LTS
 before 1.6.1-2ubuntu0.1, plus listed versions
1.5.4-1ubuntu11.6-11.6.1-11.6.1-2
1.6.1-2ubuntu0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubchristasa/CVE-2014-04722020-09-23

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open