{"id":"CVE-2018-14574","published":"2018-08-03T17:00:00Z","modified":"2024-08-05T09:29:51Z","title":"django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect","vendor":null,"product":null,"tier":"tail","description":{"text":"django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.2549,"percentile":0.97948,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.djangoproject.com/weblog/2018/aug/01/security-releases/","tags":["x_refsource_CONFIRM"]},{"url":"https://usn.ubuntu.com/3726-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://www.debian.org/security/2018/dsa-4264","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securitytracker.com/id/1041403","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0265","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/104970","tags":["vdb-entry","x_refsource_BID"]}],"priority":{"score":24.6,"factors":[{"name":"EPSS percentile","points":19.59},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"nuclei":[{"id":"CVE-2018-14574","name":"Django - Open Redirect","severity":"medium","path":"http/cves/2018/CVE-2018-14574.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14574.yaml"}],"provenance":"source"},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=2.0, <2.0.8",">=1.11, <1.11.15"],"patched":["2.0.8","1.11.15"],"from":["GHSA-5hg3-6c2f-f3wr","PYSEC-2018-2"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0037","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2018-14574","children":[{"from":"CVE-2018-14574","to":"CVE-2021-44420","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/urls/resolvers.py"],"commits":["https://github.com/django/django/commit/6fffc3c6d420e44f4029d5643f38d00a39b08525","https://github.com/django/django/commit/c4e5ff7fdb5fce447675e90291fd33fddd052b3c","https://github.com/django/django/commit/d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2018-6188","published":"2018-02-05","fixed":"2.0.2","kev":false},{"cve":"CVE-2018-7536","published":"2018-03-09","fixed":"2.0.3","kev":false,"link":{"from":"CVE-2018-7536","to":"CVE-2018-14574","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.11.11","toFixed":"1.11.15","daysApart":147},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"2.0.3","toFixed":"2.0.8","daysApart":147}]}},{"cve":"CVE-2018-7537","published":"2018-03-09","fixed":"2.0.3","kev":false},{"cve":"CVE-2018-14574","published":"2018-08-03","fixed":"2.0.8","kev":false},{"cve":"CVE-2018-16984","published":"2018-10-02","fixed":"2.1.2","kev":false},{"cve":"CVE-2019-3498","published":"2019-01-09","fixed":"2.1.5","kev":false,"link":{"from":"CVE-2018-14574","to":"CVE-2019-3498","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.11.15","toFixed":"1.11.18","daysApart":159},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"2.0.8","toFixed":"2.0.10","daysApart":159}]}},{"cve":"CVE-2019-6975","published":"2019-02-11","fixed":"2.1.7","kev":false}],"package":"PyPI:Django"}}