Vulnerability advisory

GHSA-wxg3-mfph-qg9w

Django Might Allow CSRF Requests via URL Verification

Published May 14, 2022Updated Sep 16, 2024OSV record ↗

Also known as CVE-2011-4138PYSEC-2011-3

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
All versions before 1.2.7	`1.2.7`Advisories →
Also listed as affected (16) `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1` `1.1.1` `1.1.2` `1.1.3` `1.1.4` `1.2` `1.2.1` `1.2.2` `1.2.3` `1.2.4` `1.2.5` `1.2.6`
`1.3` to before 1.3.1	`1.3.1`Advisories →
Also listed as affected (1) `1.3`

Description

The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.

GHSA-wxg3-mfph-qg9w

Affected versions

django PyPI

Description

References