{"id":"CVE-2014-0474","aliases":["DEBIAN-CVE-2014-0474","DSA-2934-1","EUVD-2014-0011","GHSA-wqjj-hx84-v449","MGASA-2014-0196","PYSEC-2014-3","RHSA-2014:0456","RHSA-2014:0457","UBUNTU-CVE-2014-0474","USN-2169-1"],"status":"published","title":"Django Vulnerable to MySQL Injection","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04845,"percentile":0.92081,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399","CWE-89"],"published":"2014-04-22T00:00:00Z","modified":"2026-10-23T15:47:39Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.4.11","1.5.6","1.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.6.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3+squeeze10"}]}],"versions":["1.2.3-3","1.2.3-3+squeeze1","1.2.3-3+squeeze2","1.2.3-3+squeeze3","1.2.3-3+squeeze5","1.2.3-3+squeeze6","1.2.3-3+squeeze7","1.2.3-3+squeeze8","1.2.3-3+squeeze9"],"bundled":5},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u7"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7~bpo60+1"],"bundled":5},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.6"}]}],"versions":["1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.3"}]}],"versions":["1.6","1.6.1","1.6.2"]},{"source":"osv","ecosystem":"Mageia:3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-1.1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"python-django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"},{"introduced":"1.5"},{"fixed":"1.5.6"},{"introduced":"1.6"},{"fixed":"1.6.3"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6","1.6.1","1.6.2"]},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"Django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"Django14-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"Django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"Django14-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"djangoproject","product":"django"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2169-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2014/apr/21/security/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0457.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/61281","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2934","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0456.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0474","tags":["advisory"]},{"url":"https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292","tags":["web"]},{"url":"https://github.com/django/django/commit/985434fb1d6bf2335bf96c6ebf91c3674f1f399f","tags":["web"]},{"url":"https://github.com/django/django/commit/aa80f498de6d687e613860933ac58433ab71ea4b","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-3.yaml","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2014/apr/21/security","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wqjj-hx84-v449","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0474","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0196.html","tags":["advisory"]},{"url":"http://www.ubuntu.com/usn/usn-2169-1/","tags":["web"]},{"url":"http://www.ubuntu.com/usn/usn-2169-2/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13251","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0456","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1090588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1090592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1090593","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0456.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0472","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0472","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0473","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0473","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0474","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0474","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0457","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0457.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0474","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2169-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0473","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0474","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2014-04-23T14:00:00Z","modified":"2024-08-06T09:20:18.434Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0011","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2014-04-23T14:00:00Z","modified":"2024-08-06T09:20:18Z","updated_at":"2026-11-03T01:57:21.099925Z"}],"ghsa":[{"id":"GHSA-wqjj-hx84-v449","title":"Django Vulnerable to MySQL Injection","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2022-05-17T03:07:04Z","modified":"2024-09-18T20:04:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2014-0474","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2014-04-23T15:55:03.237Z","modified":"2026-06-17T00:03:06.6Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"GHSA-wqjj-hx84-v449","title":"Django Vulnerable to MySQL Injection","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2022-05-17T03:07:04Z","modified":"2025-04-13T23:38:33.070493Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"CVE-2014-0474","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2014-04-23T15:55:03Z","modified":"2026-04-16T06:25:53.541067243Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0474","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2014-04-23T15:55:03.237Z","modified":"2026-10-23T15:47:39.756428035Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2934-1","title":"python-django - security update","status":"published","published":"2014-05-19T00:00:00Z","modified":"2026-03-09T01:23:37.983814Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0196","title":"Updated python-django packages fix multiple vulnerabilities","description":"Updated python-django and python-dgango14 packages fix security vulnerabilities:\n\nBenjamin Bach discovered that Django incorrectly handled dotted Python\npaths when using the reverse() function. An attacker could use this issue\nto cause Django to import arbitrary modules from the Python path, resulting\nin possible code execution. (CVE-2014-0472)\n\nPaul McMillan discovered that Django incorrectly cached certain pages that\ncontained CSRF cookies. An attacker could possibly use this flaw to obtain\na valid cookie and perform attacks which bypass the CSRF restrictions.\n(CVE-2014-0473)\n\nMichael Koziarski discovered that Django did not always perform explicit\nconversion of certain fields when using a MySQL database. An attacker\ncould possibly use this issue to obtain unexpected results. (CVE-2014-0474)\n","status":"published","published":"2014-04-28T15:54:39Z","modified":"2026-04-16T06:24:16.507811222Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"PYSEC-2014-3","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2014-04-23T15:55:00Z","modified":"2026-06-10T17:00:56.143040458Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2014:0456","title":"Red Hat Security Advisory: Django security update","status":"published","published":"2024-09-15T21:39:58Z","modified":"2025-11-22T10:50:40Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0457","title":"Red Hat Security Advisory: Django security update","status":"published","published":"2024-09-15T21:40:03Z","modified":"2025-11-22T10:50:41Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-0474","description":"The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\"","status":"published","published":"2014-04-22T00:00:00Z","modified":"2026-02-04T04:30:53.426235Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2169-1","title":"python-django vulnerabilities","description":"Benjamin Bach discovered that Django incorrectly handled dotted Python\npaths when using the reverse() function. An attacker could use this issue\nto cause Django to import arbitrary modules from the Python path, resulting\nin possible code execution. (CVE-2014-0472)\n\nPaul McMillan discovered that Django incorrectly cached certain pages that\ncontained CSRF cookies. An attacker could possibly use this flaw to obtain\na valid cookie and perform attacks which bypass the CSRF restrictions.\n(CVE-2014-0473)\n\nMichael Koziarski discovered that Django did not always perform explicit\nconversion of certain fields when using a MySQL database. An attacker\ncould possibly use this issue to obtain unexpected results. (CVE-2014-0474)\n","status":"published","published":"2014-04-22T11:58:31Z","modified":"2026-02-10T04:40:48Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}