{"id":"CVE-2014-0483","aliases":["DEBIAN-CVE-2014-0483","DLA-65-1","DSA-3010-1","EUVD-2014-0015","GHSA-rw75-m7gp-92m3","MGASA-2014-0366","PYSEC-2014-7","SUSE-SU-2015:0563-1","SUSE-SU-2015:0695-1","UBUNTU-CVE-2014-0483","USN-2347-1"],"status":"published","title":"Django data leakage via querystring manipulation in admin","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.","severity":{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01984,"percentile":0.8071,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-264"],"published":"2014-08-22T00:00:00Z","modified":"2026-10-23T15:47:31Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.4.14","1.5.9","1.6.6","1.7c3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.6.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.9"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7a1"},{"fixed":"1.7c3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3+squeeze11"}]}],"versions":["1.2.3-3","1.2.3-3+squeeze1","1.2.3-3+squeeze10","1.2.3-3+squeeze2","1.2.3-3+squeeze3","1.2.3-3+squeeze5","1.2.3-3+squeeze6","1.2.3-3+squeeze7","1.2.3-3+squeeze8","1.2.3-3+squeeze9"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u8"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7","1.4.5-1+deb7u7~bpo60+1","1.4.5-1+deb7u8~bpo60+1"],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.9"}]}],"versions":["1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.6"}]}],"versions":["1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7a1"},{"fixed":"1.7c3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"python-django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-1.3.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"2b31342cdf14fc20e07c43d258f1e7334ad664a6"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14"},{"introduced":"1.5"},{"fixed":"1.5.9"},{"introduced":"1.6"},{"fixed":"1.6.6"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7c2","1.7c1","1.7b4","1.7b3","1.7b2","1.7b1","1.7a2","1.0"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.4"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.4"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3"],"bundled":4}],"products":[{"vendor":"djangoproject","product":"django"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"https://www.djangoproject.com/weblog/2014/aug/20/security/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"http://secunia.com/advisories/61276","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/61281","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-3010","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix","web"]},{"url":"http://secunia.com/advisories/59782","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0483","tags":["advisory"]},{"url":"https://web.archive.org/web/20151016194735/http://secunia.com/advisories/61276","tags":["web"]},{"url":"https://web.archive.org/web/20151016202523/http://secunia.com/advisories/59782","tags":["web"]},{"url":"https://web.archive.org/web/20151023143840/http://secunia.com/advisories/61281","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2014/aug/20/security","tags":["web"]},{"url":"https://github.com/django/django/commit/027bd348642007617518379f8b02546abacaa6e0","tags":["web"]},{"url":"https://github.com/django/django/commit/2a446c896e7c814661fb9c4f212b071b2a7fa446","tags":["web"]},{"url":"https://github.com/django/django/commit/f7c494f2506250b8cb5923714360a3642ed63e0f","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-7.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rw75-m7gp-92m3","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0483","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0366.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13963","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/893087","tags":["report"]},{"url":"https://bugzilla.suse.com/893088","tags":["report"]},{"url":"https://bugzilla.suse.com/893089","tags":["report"]},{"url":"https://bugzilla.suse.com/893090","tags":["report"]},{"url":"https://bugzilla.suse.com/913053","tags":["report"]},{"url":"https://bugzilla.suse.com/913054","tags":["report"]},{"url":"https://bugzilla.suse.com/913055","tags":["report"]},{"url":"https://bugzilla.suse.com/913056","tags":["report"]},{"url":"https://bugzilla.suse.com/914706","tags":["report"]},{"url":"https://bugzilla.suse.com/923176","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2317","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150695-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0483","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2347-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0482","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0483","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.","status":"published","published":"2014-08-26T14:00:00Z","modified":"2024-08-06T09:20:18.489Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2014-0015","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.","status":"published","published":"2014-08-26T14:00:00Z","modified":"2024-08-06T09:20:18Z","updated_at":"2026-11-03T01:57:21.099925Z"}],"ghsa":[{"id":"GHSA-rw75-m7gp-92m3","title":"Django data leakage via querystring manipulation in admin","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a `/admin/auth/user/?pop=1\u0026t=password` URI.","status":"published","published":"2022-05-14T02:09:22Z","modified":"2024-09-18T16:07:34Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2014-0483","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.","status":"published","published":"2014-08-26T14:55:05.347Z","modified":"2026-06-17T00:03:07.66Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"GHSA-rw75-m7gp-92m3","title":"Django data leakage via querystring manipulation in admin","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a `/admin/auth/user/?pop=1\u0026t=password` URI.","status":"published","published":"2022-05-14T02:09:22Z","modified":"2024-09-18T16:24:53.89509Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"CVE-2014-0483","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.","status":"published","published":"2014-08-26T14:55:05Z","modified":"2026-04-16T06:15:10.287687204Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0483","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.","status":"published","published":"2014-08-26T14:55:05.347Z","modified":"2026-10-23T15:47:31.00853762Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DLA-65-1","title":"python-django - security update","status":"published","published":"2014-09-29T00:00:00Z","modified":"2026-03-09T02:11:08.694166Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3010-1","title":"python-django - security update","status":"published","published":"2014-08-22T00:00:00Z","modified":"2026-03-09T01:18:49.83014Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0366","title":"Updated python-django packages fix multiple vulnerabilities","description":"Updated python-django and python-django14 packages fix security vulnerabilities:\n\nThese releases address an issue with reverse() generating external URLs\n(CVE-2014-0480); a denial of service involving file uploads  (CVE-2014-0481);\na potential session hijacking issue in the remote-user middleware\n(CVE-2014-0482); and a data leak in the administrative interface\n(CVE-2014-0483).\n","status":"published","published":"2014-09-05T09:07:37Z","modified":"2026-04-16T06:22:42.127485522Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"PYSEC-2014-7","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.","status":"published","published":"2014-08-26T14:55:00Z","modified":"2026-06-10T17:00:56.928745854Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2015:0563-1","title":"Security update for python-django","description":"\npython-django was updated to 1.5.10 fixing bugs and security issues:\n\n    * Prevented reverse() from generating URLs pointing to other hosts to\n      prevent phishing attacks. (bnc#893087, CVE-2014-0480)\n    * Removed O(n) algorithm when uploading duplicate file names to fix\n      file upload denial of service. (bnc#893088, CVE-2014-0481)\n    * Modified RemoteUserMiddleware to logout on REMOTE_USE change to\n      prevent session hijacking. (bnc#893089, CVE-2014-0482)\n    * Prevented data leakage in contrib.admin via query string\n      manipulation. (bnc#893090, CVE-2014-0483)\n\nSecurity Issues:\n\n    * CVE-2014-0480\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480\u003e\n    * CVE-2014-0481\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481\u003e\n    * CVE-2014-0482\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482\u003e\n    * CVE-2014-0483\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483\u003e\n\n","status":"published","published":"2014-09-03T15:51:02Z","modified":"2026-02-04T02:24:37.285672Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0695-1","title":"Security update for python-django","description":"\npython-django was updated to 1.5.10 fixing bugs and security issues:\n\n    * Prevented reverse() from generating URLs pointing to other hosts to\n      prevent phishing attacks. (bnc#893087, CVE-2014-0480)\n    * Removed O(n) algorithm when uploading duplicate file names to fix\n      file upload denial of service. (bnc#893088, CVE-2014-0481)\n    * Modified RemoteUserMiddleware to logout on REMOTE_USE change to\n      prevent session hijacking. (bnc#893089, CVE-2014-0482)\n    * Prevented data leakage in contrib.admin via query string\n      manipulation. (bnc#893090, CVE-2014-0483)\n\nSecurity Issues:\n\n    * CVE-2014-0480\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480\u003e\n    * CVE-2014-0481\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481\u003e\n    * CVE-2014-0482\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482\u003e\n    * CVE-2014-0483\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483\u003e\n\n","status":"published","published":"2014-09-03T15:51:02Z","modified":"2026-02-04T02:17:29.821596Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-0483","description":"The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.","status":"published","published":"2014-08-26T00:00:00Z","modified":"2026-02-04T02:31:03.116922Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2347-1","title":"python-django vulnerabilities","description":"Florian Apolloner discovered that Django incorrectly validated URLs. A\nremote attacker could use this issue to conduct phishing attacks.\n(CVE-2014-0480)\n\nDavid Wilson discovered that Django incorrectly handled file name\ngeneration. A remote attacker could use this issue to cause Django to\nconsume resources, resulting in a denial of service. (CVE-2014-0481)\n\nDavid Greisen discovered that Django incorrectly handled certain headers in\ncontrib.auth.middleware.RemoteUserMiddleware. A remote authenticated user\ncould use this issue to hijack web sessions. (CVE-2014-0482)\n\nCollin Anderson discovered that Django incorrectly checked if a field\nrepresented a relationship between models in the administrative interface.\nA remote authenticated user could use this issue to possibly obtain\nsensitive information. (CVE-2014-0483)\n","status":"published","published":"2014-09-16T11:49:24Z","modified":"2026-02-10T04:40:50Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}