Every CVE Search/ Get API key

CVE-2014-3730

Django Allows Open Redirects

4.3 MediumFix available

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Exploit likelihood

3.14%Up 1.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
CVE-2014-3730
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
CVE-2014-3730
Updated
2026-11-02
EUVDEUVD-2014-0010 No score

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
EUVD-2014-0010
Updated
2026-11-03
GitHub AdvisoriesGHSA-vq3h-3q7v-9prw 7.7

Django Allows Open Redirects

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
GHSA-vq3h-3q7v-9prw
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-vq3h-3q7v-9prw 7.7

Django Allows Open Redirects

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
GHSA-vq3h-3q7v-9prw
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSV No score

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
CVE-2014-3730
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-3730 No score

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
DEBIAN-CVE-2014-3730
Updated
2026-11-02
OSVMGASA-2014-0231 No score

Updated python-django package fix two vulnerabilities

Updated python-django and python-dgango14 packages fix security vulnerabilities:

Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby discovered that Django improperly removed Vary and Cache-Control headers from HTTP responses when replying to a request from an Internet Explorer or Chrome Frame client. An attacker may use this to retrieve private data or poison caches. This update removes workarounds for bugs in Internet Explorer 6 and 7 (CVE-2014-1418).

Peter Kuma and Gavin Wahl discovered that Django did not correctly validate some malformed URLs, which are accepted by some browsers. An attacker may use this to cause unexpected redirects (CVE-2014-3730).

Record
MGASA-2014-0231
Updated
2026-11-02
OSVPYSEC-2014-20 No score

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
PYSEC-2014-20
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3730 No score

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

Record
UBUNTU-CVE-2014-3730
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django
PyPI
 1.4 up to 1.4.13
1.4.13
django
PyPI
 1.5 up to 1.5.8
1.5.8
django
PyPI
 1.6 up to 1.6.5
1.6.5
django
PyPI
 1.7a1 up to 1.7b4
1.7b4
python-django
Debian:12
 before 1.6.5-1
1.6.5-1
python-django
Debian:13
 before 1.6.5-1
1.6.5-1
python-django
Debian:14
 before 1.6.5-1
1.6.5-1
python-django
Debian:6.0
From an advisory covering 5 CVEs
 before 1.2.3-3+squeeze10, plus listed versions
1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze21.2.3-3+squeeze31.2.3-3+squeeze5
Show 4 moreShow less
1.2.3-3+squeeze61.2.3-3+squeeze71.2.3-3+squeeze81.2.3-3+squeeze9
1.2.3-3+squeeze10
python-django
Debian:7
From an advisory covering 5 CVEs
 before 1.4.5-1+deb7u7, plus listed versions
1.4.5-11.4.5-1+deb7u11.4.5-1+deb7u21.4.5-1+deb7u31.4.5-1+deb7u4
Show 4 moreShow less
1.4.5-1+deb7u4~bpo60+11.4.5-1+deb7u51.4.5-1+deb7u61.4.5-1+deb7u7~bpo60+1
1.4.5-1+deb7u7
django
PyPI
 1.4 up to 1.4.13, plus listed versions
1.4.11.4.101.4.111.4.121.4.2
Show 7 moreShow less
1.4.31.4.41.4.51.4.61.4.71.4.81.4.9
1.4.13
Show 7 moreShow less
Affected packages
PackageAffectedFixed
django
PyPI
 1.5 up to 1.5.8, plus listed versions
1.5.11.5.21.5.31.5.41.5.51.5.61.5.7
1.5.8
django
PyPI
 1.6 up to 1.6.5, plus listed versions
1.6.11.6.21.6.31.6.4
1.6.5
python-django
Mageia:3
From an advisory covering 2 CVEs
 before 1.4.13-1.mga3
1.4.13-1.mga3
python-django
Mageia:4
From an advisory covering 2 CVEs
 before 1.5.8-1.mga4
1.5.8-1.mga4
python-django14
Mageia:4
From an advisory covering 2 CVEs
 before 1.4.13-1.mga4
1.4.13-1.mga4
django
PyPI
 1.4 up to 1.4.13, 1.5 up to 1.5.8, 1.6 up to 1.6.5, 1.7a0 up to 1.7b4, plus listed versions
1.4.11.4.101.4.111.4.121.4.2
Show 18 moreShow less
1.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.11.5.21.5.31.5.41.5.51.5.61.5.71.6.11.6.21.6.31.6.4
1.4.131.5.81.6.51.7b4
python-django
Ubuntu:14.04:LTS
 before 1.6.1-2ubuntu0.3, plus listed versions
1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.11.6.1-2ubuntu0.2
1.6.1-2ubuntu0.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-3730 is a medium vulnerability (CVSS 4.3) in Djangoproject Django, published May 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.14%, the 87th percentile. Fixed in django 1.4.13.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open