CVE-2018-14574 Django open redirect

Medium 6.1 Published 3 Aug 2018 Updated 5 Aug 2024

An open redirect vulnerability in Django's CommonMiddleware allows attackers to redirect users to malicious sites, requiring an upgrade to patched versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-14574?

CVE-2018-14574 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 3 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

Weakness: CWE-601

Which versions are affected by CVE-2018-14574?

5 open source packages ship an affected version, including django and Django. It affects 3 products.

Package	Affected	Fixed in
`django` PyPI	From `1.11`	`1.11.15`
`django` PyPI	From `2.0`	`2.0.8, 1.11.15`
`django` PyPI	From `2.0`	`2.0.8`
`Django` PyPI	From `1.11`	`1.11.15`
`Django` PyPI	From `2.0`	`2.0.8`

Linux distribution packages (5)

`python-Django` SUSE:HPE Helion OpenStack 8	All versions	`1.11.11-3.3.1`
`python-Django` SUSE:OpenStack Cloud 8	All versions	`1.11.11-3.3.1`
`python-Django` SUSE:OpenStack Cloud Crowbar 8	All versions	`1.11.11-3.3.1`
`python-Django` SUSE:Package Hub 12	All versions	`1.11.15-11.1`
`python-Django1` SUSE:Package Hub 15	All versions	`1.11.15-bp150.3.3.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Djangoproject Django.

How do I fix CVE-2018-14574?

Upgrade django to a fixed version for your release line: 1.11.15 or 2.0.8.

Is CVE-2018-14574 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-14574 exists.

Public exploit code: 1 Nuclei template.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2018-14574, DEBIAN-CVE-2018-14574, DSA-4264-1, GHSA-5hg3-6c2f-f3wr, PYSEC-2018-2, SUSE-SU-2018:3549-1 and 4 more.