Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2012-4520 Details

Description

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145	CVE
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090666.html	CVE
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090904.html	CVE
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.html	CVE
https://bugzilla.redhat.com/show_bug.cgi?id=865164	CVE
http://secunia.com/advisories/51033	CVE	Vendor Advisory
http://secunia.com/advisories/51314	CVE	Vendor Advisory
http://securitytracker.com/id?1027708	CVE
https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3	CVE
https://github.com/django/django/commit/9305c0e12d43c4df999c3301a1f0c742264a657e	CVE
https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071	CVE
https://www.djangoproject.com/weblog/2012/oct/17/security/	CVE	PatchVendor Advisory
http://ubuntu.com/usn/usn-1632-1	CVE
http://ubuntu.com/usn/usn-1757-1	CVE
http://www.debian.org/security/2013/dsa-2634	CVE
http://www.openwall.com/lists/oss-security/2012/10/30/4	CVE
http://www.osvdb.org/86493	CVE
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145	[email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090666.html	[email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090904.html	[email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.html	[email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=865164	[email protected]
http://secunia.com/advisories/51033	[email protected]	Vendor Advisory
http://secunia.com/advisories/51314	[email protected]	Vendor Advisory
http://securitytracker.com/id?1027708	[email protected]
https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3	[email protected]
https://github.com/django/django/commit/9305c0e12d43c4df999c3301a1f0c742264a657e	[email protected]
https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071	[email protected]
https://www.djangoproject.com/weblog/2012/oct/17/security/	[email protected]	PatchVendor Advisory
http://ubuntu.com/usn/usn-1632-1	[email protected]
http://ubuntu.com/usn/usn-1757-1	[email protected]
http://www.debian.org/security/2013/dsa-2634	[email protected]
http://www.openwall.com/lists/oss-security/2012/10/30/4	[email protected]
http://www.osvdb.org/86493	[email protected]

see all 34 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-20	Improper Input Validation	[email protected]

Affected Products

Product	Versions
djangoproject django	1.3 1.3 alpha1 1.3 beta1 1.3.1 1.3.2
CPE cpe:2.3:a:djangoproject:django:1.3:::::::* cpe:2.3:a:djangoproject:django:1.3:alpha1:::::: cpe:2.3:a:djangoproject:django:1.3:beta1:::::: cpe:2.3:a:djangoproject:django:1.3.1:::::::* cpe:2.3:a:djangoproject:django:1.3.2:::::::* cpe:2.3:a:djangoproject:django:1.3.3:::::::* cpe:2.3:a:djangoproject:django:1.4:::::::* cpe:2.3:a:djangoproject:django:1.4.1:::::::* Remediation No remediation found in references.

Product

Versions

djangoproject django

1.3

1.3 alpha1

1.3 beta1

1.3.1

1.3.2

CPE

cpe:2.3:a:djangoproject:django:1.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3:beta1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.4.1:*:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 29, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 19, 2012	Initial Analysis	[email protected]