CVE-2012-4520

2012-11-1823:55:01

CWE-20

redhat

web.nvd.nist.gov

cve-2012-4520

django

httprequest

security vulnerability

nvd

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

6.6

Confidence

Low

EPSS

0.007

Percentile

79.9%

JSON

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Affected configurations

Nvd

Node

djangoprojectdjangoMatch1.3

djangoprojectdjangoMatch1.3alpha1

djangoprojectdjangoMatch1.3beta1

djangoprojectdjangoMatch1.3.1

djangoprojectdjangoMatch1.3.2

djangoprojectdjangoMatch1.3.3

Node

djangoprojectdjangoMatch1.4

djangoprojectdjangoMatch1.4.1

VendorProductVersionCPE
djangoprojectdjango1.3cpe:/a:djangoproject:django:1.3:::
djangoprojectdjango1.3cpe:/a:djangoproject:django:1.3:alpha1::
djangoprojectdjango1.3.2cpe:/a:djangoproject:django:1.3.2:::
djangoprojectdjango1.3.1cpe:/a:djangoproject:django:1.3.1:::
djangoprojectdjango1.3cpe:/a:djangoproject:django:1.3:beta1::
djangoprojectdjango1.3.3cpe:/a:djangoproject:django:1.3.3:::

Vendor	Product	Version	CPE
djangoproject	django	1.3	cpe:/a:djangoproject:django:1.3:::
djangoproject	django	1.3	cpe:/a:djangoproject:django:1.3:alpha1::
djangoproject	django	1.3.2	cpe:/a:djangoproject:django:1.3.2:::
djangoproject	django	1.3.1	cpe:/a:djangoproject:django:1.3.1:::
djangoproject	django	1.3	cpe:/a:djangoproject:django:1.3:beta1::
djangoproject	django	1.3.3	cpe:/a:djangoproject:django:1.3.3:::