Every CVE Search/ Get API key

CVE-2014-0480

Django Incorrectly Validates URLs

5.8 MediumFix available

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Exploit likelihood

2.30%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.8

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
CVE-2014-0480
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
CVE-2014-0480
Updated
2026-11-02
EUVDEUVD-2014-0012 No score

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
EUVD-2014-0012
Updated
2026-11-03
GitHub AdvisoriesGHSA-f7cm-ccfp-3q4r 8.7

Django Incorrectly Validates URLs

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
GHSA-f7cm-ccfp-3q4r
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-f7cm-ccfp-3q4r 8.7

Django Incorrectly Validates URLs

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
GHSA-f7cm-ccfp-3q4r
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSV No score

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
CVE-2014-0480
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2014-0480 No score

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
DEBIAN-CVE-2014-0480
Updated
2026-11-02
OSVMGASA-2014-0366 No score

Updated python-django packages fix multiple vulnerabilities

Updated python-django and python-django14 packages fix security vulnerabilities:

These releases address an issue with reverse() generating external URLs (CVE-2014-0480); a denial of service involving file uploads (CVE-2014-0481); a potential session hijacking issue in the remote-user middleware (CVE-2014-0482); and a data leak in the administrative interface (CVE-2014-0483).

Record
MGASA-2014-0366
Updated
2026-11-02
OSVPYSEC-2014-4 No score

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
PYSEC-2014-4
Updated
2026-11-02
OSVSUSE-SU-2015:0563-1 No score

Security update for python-django

python-django was updated to 1.5.10 fixing bugs and security issues:

* Prevented reverse() from generating URLs pointing to other hosts to
  prevent phishing attacks. (bnc#893087, CVE-2014-0480)
* Removed O(n) algorithm when uploading duplicate file names to fix
  file upload denial of service. (bnc#893088, CVE-2014-0481)
* Modified RemoteUserMiddleware to logout on REMOTE_USE change to
  prevent session hijacking. (bnc#893089, CVE-2014-0482)
* Prevented data leakage in contrib.admin via query string
  manipulation. (bnc#893090, CVE-2014-0483)

Security Issues:

* CVE-2014-0480
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480>
* CVE-2014-0481
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481>
* CVE-2014-0482
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482>
* CVE-2014-0483
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483>
Record
SUSE-SU-2015:0563-1
Updated
2026-11-02
OSVSUSE-SU-2015:0695-1 No score

Security update for python-django

python-django was updated to 1.5.10 fixing bugs and security issues:

* Prevented reverse() from generating URLs pointing to other hosts to
  prevent phishing attacks. (bnc#893087, CVE-2014-0480)
* Removed O(n) algorithm when uploading duplicate file names to fix
  file upload denial of service. (bnc#893088, CVE-2014-0481)
* Modified RemoteUserMiddleware to logout on REMOTE_USE change to
  prevent session hijacking. (bnc#893089, CVE-2014-0482)
* Prevented data leakage in contrib.admin via query string
  manipulation. (bnc#893090, CVE-2014-0483)

Security Issues:

* CVE-2014-0480
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480>
* CVE-2014-0481
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481>
* CVE-2014-0482
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482>
* CVE-2014-0483
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483>
Record
SUSE-SU-2015:0695-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0480 No score

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

Record
UBUNTU-CVE-2014-0480
Updated
2026-11-02
OSVUSN-2347-1 No score

python-django vulnerabilities

Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. (CVE-2014-0480)

David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume resources, resulting in a denial of service. (CVE-2014-0481)

David Greisen discovered that Django incorrectly handled certain headers in contrib.auth.middleware.RemoteUserMiddleware. A remote authenticated user could use this issue to hijack web sessions. (CVE-2014-0482)

Collin Anderson discovered that Django incorrectly checked if a field represented a relationship between models in the administrative interface. A remote authenticated user could use this issue to possibly obtain sensitive information. (CVE-2014-0483)

Record
USN-2347-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django
PyPI
 before 1.4.14
1.4.14
django
PyPI
 1.5 up to 1.5.9
1.5.9
django
PyPI
 1.6 up to 1.6.6
1.6.6
python-django
Debian:12
 before 1.6.6-1
1.6.6-1
python-django
Debian:13
 before 1.6.6-1
1.6.6-1
python-django
Debian:14
 before 1.6.6-1
1.6.6-1
python-django
Debian:6.0
 before 1.2.3-3+squeeze11, plus listed versions
1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze101.2.3-3+squeeze21.2.3-3+squeeze3
Show 5 moreShow less
1.2.3-3+squeeze51.2.3-3+squeeze61.2.3-3+squeeze71.2.3-3+squeeze81.2.3-3+squeeze9
1.2.3-3+squeeze11
python-django
Debian:7
 before 1.4.5-1+deb7u8, plus listed versions
1.4.5-11.4.5-1+deb7u11.4.5-1+deb7u21.4.5-1+deb7u31.4.5-1+deb7u4
Show 6 moreShow less
1.4.5-1+deb7u4~bpo60+11.4.5-1+deb7u51.4.5-1+deb7u61.4.5-1+deb7u71.4.5-1+deb7u7~bpo60+11.4.5-1+deb7u8~bpo60+1
1.4.5-1+deb7u8
django
PyPI
 before 1.4.14, plus listed versions
1.0.11.0.21.0.31.0.41.1
Show 34 moreShow less
1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.111.4.121.4.131.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.9
1.4.14
django
PyPI
 1.5 up to 1.5.9, plus listed versions
1.5.11.5.21.5.31.5.41.5.51.5.61.5.71.5.8
1.5.9
Show 6 moreShow less
Affected packages
PackageAffectedFixed
django
PyPI
 1.6 up to 1.6.6, plus listed versions
1.6.11.6.21.6.31.6.41.6.5
1.6.6
python-django
Mageia:3
 before 1.4.14-1.mga3
1.4.14-1.mga3
python-django
Mageia:4
 before 1.5.9-1.mga4
1.5.9-1.mga4
python-django14
Mageia:4
 before 1.4.14-1.3.mga4
1.4.14-1.3.mga4
django
PyPI
 before 1.4.14, 1.5 up to 1.5.9, 1.6 up to 1.6.6, plus listed versions
1.0.11.0.21.0.31.0.41.1
Show 45 moreShow less
1.1.11.1.21.1.31.1.41.21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.31.3.11.3.21.3.31.3.41.3.51.3.61.3.71.41.4.11.4.101.4.111.4.121.4.131.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.11.5.21.5.31.5.41.5.51.5.61.5.71.5.81.6.11.6.21.6.3
1.4.141.5.91.6.6
python-django
Ubuntu:14.04:LTS
 before 1.6.1-2ubuntu0.4, plus listed versions
1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.11.6.1-2ubuntu0.21.6.1-2ubuntu0.3
1.6.1-2ubuntu0.4

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0480 is a medium vulnerability (CVSS 5.8) in Djangoproject Django, published August 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.30%, the 83rd percentile. Fixed in django 1.4.14.

References

Show 40 moreShow less
This page doesn't list everything

Left out here: 2 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open