5.1
CVE-2014-0472
- EPSS 5.88%
- Veröffentlicht 23.04.2014 15:55:02
- Zuletzt bearbeitet 12.04.2025 10:46:40
- Quelle security@debian.org
- Teams Watchlist Login
- Unerledigt Login
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Djangoproject ≫ Django Version <= 1.4.10
Djangoproject ≫ Django Version1.4
Djangoproject ≫ Django Version1.4.1
Djangoproject ≫ Django Version1.4.2
Djangoproject ≫ Django Version1.4.3
Djangoproject ≫ Django Version1.4.4
Djangoproject ≫ Django Version1.4.5
Djangoproject ≫ Django Version1.4.6
Djangoproject ≫ Django Version1.4.7
Djangoproject ≫ Django Version1.4.8
Djangoproject ≫ Django Version1.4.9
Djangoproject ≫ Django Version1.6
Djangoproject ≫ Django Version1.6.1
Djangoproject ≫ Django Version1.6.2
Djangoproject ≫ Django Version1.7 Updatealpha1
Djangoproject ≫ Django Version1.7 Updatealpha2
Djangoproject ≫ Django Version1.7 Updatebeta1
Djangoproject ≫ Django Version1.5
Djangoproject ≫ Django Version1.5.1
Djangoproject ≫ Django Version1.5.2
Djangoproject ≫ Django Version1.5.3
Djangoproject ≫ Django Version1.5.4
Djangoproject ≫ Django Version1.5.5
Canonical ≫ Ubuntu Linux Version10.04 Update- Editionlts
Canonical ≫ Ubuntu Linux Version12.04 Update- Editionlts
Canonical ≫ Ubuntu Linux Version12.10
Canonical ≫ Ubuntu Linux Version13.10
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 5.88% | 0.902 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.1 | 4.9 | 6.4 |
AV:N/AC:H/Au:N/C:P/I:P/A:P
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.