CVE-2012-4520
Django Allows Arbitrary URL Generation
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
Exploit likelihood
What each source reports
NVD Score used
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
- Record
CVE-2012-4520- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
- Record
CVE-2012-4520- Updated
- 2026-11-02
EUVDEUVD-2012-0006 No score
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
- Record
EUVD-2012-0006- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2655-q453-22f9
Django Allows Arbitrary URL Generation
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
- Record
GHSA-2655-q453-22f9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-2655-q453-22f9
Django Allows Arbitrary URL Generation
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
- Record
GHSA-2655-q453-22f9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
- Record
CVE-2012-4520- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4520 No score
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
- Record
DEBIAN-CVE-2012-4520- Updated
- 2026-11-02
OSVPYSEC-2012-7 No score
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
- Record
PYSEC-2012-7- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
1.3 up to 1.3.4 | 1.3.4 |
djangoPyPI |
1.4 up to 1.4.2 | 1.4.2 |
python-djangoDebian:12 |
before 1.4.2-1 | 1.4.2-1 |
python-djangoDebian:13 |
before 1.4.2-1 | 1.4.2-1 |
python-djangoDebian:14 |
before 1.4.2-1 | 1.4.2-1 |
python-djangoDebian:6.0 |
before 1.2.3-3+squeeze5, plus listed versions 1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze21.2.3-3+squeeze3 |
1.2.3-3+squeeze5 |
djangoPyPI |
1.3 up to 1.3.4, plus listed versions 1.3.11.3.21.3.3 |
1.3.4 |
djangoPyPI |
1.4 up to 1.4.2, plus listed versions 1.4.1 |
1.4.2 |
djangoPyPI |
1.3 up to 1.3.4, 1.4 up to 1.4.2, plus listed versions 1.3.11.3.21.3.31.4.11.2.11.21.11.0 |
1.3.41.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4520 is a medium vulnerability (CVSS 6.4) in Djangoproject Django, published November 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.67%, the 89th percentile. Fixed in django 1.3.4.
References
openwall.com/lists/oss-security/2012/10/30/4
securitytracker.com/id?1027708
github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071
osvdb.org/86493
secunia.com/advisories/51314
bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145
Show 17 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.html
ubuntu.com/usn/usn-1757-1
debian.org/security/2013/dsa-2634
djangoproject.com/weblog/2012/oct/17/security
bugzilla.redhat.com/show_bug.cgi?id=865164
nvd.nist.gov/vuln/detail/CVE-2012-4520
web.archive.org/web/20140417023920/http://securitytracker.com/id?1027708
security-tracker.debian.org/tracker/CVE-2012-4520