CVE-2018-14574

EUVD-2018-0037
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
djangoprojectdjango
1.11 ≤
𝑥
< 1.11.15
djangoprojectdjango
2.0 ≤
𝑥
< 2.0.8
debiandebian_linux
9.0
canonicalubuntu_linux
18.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-django
bookworm
3:3.2.19-1+deb12u1
fixed
bookworm (security)
3:3.2.19-1+deb12u1
fixed
bullseye
2:2.2.28-1~deb11u2
fixed
bullseye (security)
2:2.2.28-1~deb11u2
fixed
jessie
not-affected
sid
3:4.2.16-1
fixed
trixie
3:4.2.16-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-django
bionic
Fixed 1:1.11.11-1ubuntu1.1
released
trusty
not-affected
xenial
not-affected
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/104970
http://www.securitytracker.com/id/1041403
https://access.redhat.com/errata/RHSA-2019:0265
https://usn.ubuntu.com/3726-1/
https://www.debian.org/security/2018/dsa-4264
https://www.djangoproject.com/weblog/2018/aug/01/security-releases/
http://www.securityfocus.com/bid/104970
http://www.securitytracker.com/id/1041403
https://access.redhat.com/errata/RHSA-2019:0265
https://usn.ubuntu.com/3726-1/
https://www.debian.org/security/2018/dsa-4264
https://www.djangoproject.com/weblog/2018/aug/01/security-releases/