Arbitrary Code Execution Affecting django package, versions [,1.4.11) [1.5,1.5.6) [1.6,1.6.3) [1.7,1.7.1)
Snyk CVSS
Attack Complexity
High
Threat Intelligence
EPSS
2.4% (90th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-DJANGO-40025
- published 23 Apr 2014
- disclosed 23 Apr 2014
- credit Benjamin Bach
Introduced: 23 Apr 2014
CVE-2014-0472 Open this link in a new tabHow to fix?
Upgrade to versions 1.7b2, 1.6.3, 1.5.6, 1.4.11 or greater.
Overview
Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.
Affected versions of this package are vulnerable to Arbitrary Code Execution attacks. The django.core.urlresolvers.reverse function allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."