Django Allows Arbitrary URL Generation

MEDIUM 6.4CVE-2012-4520 · GHSA-2655-q453-22f9 · PYSEC-2012-7 · Published 18/11/2012 · updated 16/06/2026

In short

CVE-2012-4520 is a MEDIUM (CVSS 6.4) vulnerability affecting django, django (djangoproject).
Chance of exploitation in the next 30 days (EPSS): 3.7%, higher than 89.6% of all vulnerabilities.
Fix: update to 1.3.4, 1.4.2 or later.

Package	Affected versions	Patched versions
django PyPI	`≥ 1.3, < 1.3.4≥ 1.4, < 1.4.2`	`1.3.41.4.2`
django djangoproject	`= 1.3= 1.3.1= 1.3.2= 1.3.3= 1.4= 1.4.1`	No fix yet

Description

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

NVD description

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.