CVE-2014-3730:
Django Allows Open Redirects
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.75867%
CWE
Published
5/14/2022
Updated
9/18/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 1.4, < 1.4.13 | 1.4.13 |
| Django | pip | >= 1.5, < 1.5.8 | 1.5.8 |
| Django | pip | >= 1.6, < 1.6.5 | 1.6.5 |
| Django | pip | >= 1.7a1, < 1.7b4 | 1.7b4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability documentation explicitly identifies django.util.http.is_safe_url as the root cause. The GitHub commit diff shows critical security-focused modifications to this function, including adding backslash replacement, triple-slash checks, and hostname validation. Multiple advisories (CVE-2014-3730, GHSA-vq3h-3q7v-9prw) and patch notes confirm these changes were required to prevent open redirects. The function's pre-patch behavior matches the described vulnerability symptoms of improper URL validation.