Description

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

Remediation

References

CVE-2014-0472

Related Vulnerabilities

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (2.8.7)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-0273)

WordPress Plugin WP DSGVO Tools (GDPR) Cross-Site Request Forgery (2.2.18)

WordPress Plugin Startklar Elementor Addons Arbitrary File Deletion (1.7.13)

WordPress Plugin Community Events SQL Injection (1.3.5)

Severity

Medium

Classification

CVE-2014-0472 CWE-94

Tags

Missing Update Known Vulnerabilities