{"id":"CVE-2014-3730","aliases":["DEBIAN-CVE-2014-3730","DSA-2934-1","EUVD-2014-0010","GHSA-vq3h-3q7v-9prw","MGASA-2014-0231","PYSEC-2014-20","UBUNTU-CVE-2014-3730"],"status":"published","title":"Django Allows Open Redirects","description":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.03138,"percentile":0.88078,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-05-16T15:00:00Z","modified":"2026-10-23T15:47:26Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.4.13","1.5.8","1.6.5","1.7b4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.6.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.6.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.6.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4"},{"fixed":"1.4.13"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7a1"},{"fixed":"1.7b4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3+squeeze10"}]}],"versions":["1.2.3-3","1.2.3-3+squeeze1","1.2.3-3+squeeze2","1.2.3-3+squeeze3","1.2.3-3+squeeze5","1.2.3-3+squeeze6","1.2.3-3+squeeze7","1.2.3-3+squeeze8","1.2.3-3+squeeze9"],"bundled":5},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u7"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7~bpo60+1"],"bundled":5},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4"},{"fixed":"1.4.13"}]}],"versions":["1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.8"}]}],"versions":["1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.5"}]}],"versions":["1.6","1.6.1","1.6.2","1.6.3","1.6.4"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7a1"},{"fixed":"1.7b4"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"python-django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4"},{"fixed":"1.4.13"},{"introduced":"1.5"},{"fixed":"1.5.8"},{"introduced":"1.6"},{"fixed":"1.6.5"},{"introduced":"1.7a0"},{"fixed":"1.7b4"}]}],"versions":["1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.6","1.6.1","1.6.2","1.6.3","1.6.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.3"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"djangoproject","product":"django"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://secunia.com/advisories/61281","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www.debian.org/security/2014/dsa-2934","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://ubuntu.com/usn/usn-2212-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/67410","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/14/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3730","tags":["advisory"]},{"url":"https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3","tags":["web"]},{"url":"https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df","tags":["web"]},{"url":"https://github.com/django/django/commit/ad32c218850ad40972dcef57beb460f8c979dd6d","tags":["web"]},{"url":"https://web.archive.org/web/20200228171223/http://www.securityfocus.com/bid/67410","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-20.yaml","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vq3h-3q7v-9prw","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3730","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0231.html","tags":["advisory"]},{"url":"http://www.ubuntu.com/usn/usn-2212-1/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3730","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2212-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3730","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3730","description":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2014-05-16T15:00:00Z","modified":"2024-08-06T10:50:18.338Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-0010","description":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2014-05-16T15:00:00Z","modified":"2024-08-06T10:50:18Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-vq3h-3q7v-9prw","title":"Django Allows Open Redirects","description":"The `django.util.http.is_safe_url` function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2022-05-14T02:09:43Z","modified":"2024-09-18T19:43:08Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2014-3730","description":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2014-05-16T15:55:05.44Z","modified":"2026-06-17T00:08:48.937Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"GHSA-vq3h-3q7v-9prw","title":"Django Allows Open Redirects","description":"The `django.util.http.is_safe_url` function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2022-05-14T02:09:43Z","modified":"2025-02-19T05:38:07.914072Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"CVE-2014-3730","description":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2014-05-16T15:55:05Z","modified":"2026-04-16T06:26:32.415109952Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3730","description":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2014-05-16T15:55:05.44Z","modified":"2026-10-23T15:47:26.611268639Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DSA-2934-1","title":"python-django - security update","status":"published","published":"2014-05-19T00:00:00Z","modified":"2026-03-09T01:23:37.983814Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0231","title":"Updated python-django package fix two vulnerabilities","description":"Updated python-django and python-dgango14 packages fix security\nvulnerabilities:\n\nStephen Stewart, Michael Nelson, Natalia Bidart and James Westby\ndiscovered that Django improperly removed Vary and Cache-Control headers\nfrom HTTP responses when replying to a request from an Internet Explorer\nor Chrome Frame client. An attacker may use this to retrieve private data\nor poison caches. This update removes workarounds for bugs in Internet\nExplorer 6 and 7 (CVE-2014-1418).\n\nPeter Kuma and Gavin Wahl discovered that Django did not correctly\nvalidate some malformed URLs, which are accepted by some browsers. An\nattacker may use this to cause unexpected redirects (CVE-2014-3730).\n","status":"published","published":"2014-05-19T18:53:32Z","modified":"2026-04-16T06:26:11.442069152Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"PYSEC-2014-20","description":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2014-05-16T15:55:00Z","modified":"2026-06-10T17:00:46.248439653Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"UBUNTU-CVE-2014-3730","description":"The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"","status":"published","published":"2014-05-16T15:55:00Z","modified":"2026-02-04T03:58:59.778388Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}