diff --git a/advisories/github-reviewed/2022/05/GHSA-vq3h-3q7v-9prw/GHSA-vq3h-3q7v-9prw.json b/advisories/github-reviewed/2022/05/GHSA-vq3h-3q7v-9prw/GHSA-vq3h-3q7v-9prw.json index 0d822c964fc..37ef61129e2 100644 --- a/advisories/github-reviewed/2022/05/GHSA-vq3h-3q7v-9prw/GHSA-vq3h-3q7v-9prw.json +++ b/advisories/github-reviewed/2022/05/GHSA-vq3h-3q7v-9prw/GHSA-vq3h-3q7v-9prw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vq3h-3q7v-9prw", - "modified": "2023-08-15T22:09:31Z", + "modified": "2024-09-18T19:43:07Z", "published": "2022-05-14T02:09:43Z", "aliases": [ "CVE-2014-3730" @@ -9,20 +9,27 @@ "summary": "Django Allows Open Redirects", "details": "The `django.util.http.is_safe_url` function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\"", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.4.0" + "introduced": "1.4" }, { "fixed": "1.4.13" @@ -34,14 +41,14 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.5.0" + "introduced": "1.5" }, { "fixed": "1.5.8" @@ -53,14 +60,19 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" + }, + "ecosystem_specific": { + "affected_functions": [ + "django.utils.http.is_safe_url" + ] }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.6.0" + "introduced": "1.6" }, { "fixed": "1.6.5" @@ -68,6 +80,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "Django" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.7a1" + }, + { + "fixed": "1.7b4" + } + ] + } + ] } ], "references": [ @@ -87,6 +118,14 @@ "type": "WEB", "url": "https://github.com/django/django/commit/ad32c218850ad40972dcef57beb460f8c979dd6d" }, + { + "type": "PACKAGE", + "url": "https://github.com/django/django" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-20.yaml" + }, { "type": "WEB", "url": "https://web.archive.org/web/20200228171223/http://www.securityfocus.com/bid/67410" @@ -99,6 +138,10 @@ "type": "WEB", "url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html" }, + { + "type": "WEB", + "url": "http://secunia.com/advisories/61281" + }, { "type": "WEB", "url": "http://ubuntu.com/usn/usn-2212-1" @@ -120,7 +163,7 @@ "cwe_ids": [ "CWE-20" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-08-15T22:09:31Z", "nvd_published_at": "2014-05-16T15:55:00Z"