CVE-2014-0474: Django Vulnerable to MySQL Injection – CVSS 10.0 · Watchpost

← All vulnerabilities

Django Vulnerable to MySQL Injection

CRITICAL 10.0CVE-2014-0474 · GHSA-wqjj-hx84-v449 · PYSEC-2014-3 · Published 23/04/2014 · updated 17/06/2026

In short

CVE-2014-0474 is a CRITICAL (CVSS 10.0) vulnerability affecting django, django (djangoproject).
Chance of exploitation in the next 30 days (EPSS): 4.9%, higher than 92.1% of all vulnerabilities.
Fix: update to 1.5.6, 1.6.3, 1.4.11 or later.

Package	Affected versions	Patched versions
django PyPI	`≥ 1.5, < 1.5.6≥ 1.6, < 1.6.3< 1.4.11`	`1.5.61.6.31.4.11`
django djangoproject	`= 1.4= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.4.5= 1.4.6= 1.4.7= 1.4.8= 1.4.9= 1.5= 1.5.1= 1.5.2= 1.5.3= 1.5.4= 1.5.5= 1.6= 1.6.1= 1.6.2= 1.7≤ 1.4.10`	No fix yet

Description

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."

NVD description

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."

References

nvd.nist.gov/vuln/detail/CVE-2014-0474 · ADVISORY
django/django commit 5f0829a · WEB
django/django commit 985434f · WEB
django/django commit aa80f49 · WEB
django/django · PACKAGE
pypa/advisory-database · WEB
djangoproject.com/weblog/2014/apr/21/security · WEB
lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · WEB
rhn.redhat.com/errata/RHSA-2014-0456.html · WEB
rhn.redhat.com/errata/RHSA-2014-0457.html · WEB
debian.org/security/2014/dsa-2934 · WEB
ubuntu.com/usn/USN-2169-1

More vulnerabilities in django

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free