1. CVE-Search
  2. CVE-2011-4137
ID CVE-2011-4137
Summary The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.
References
Vulnerable Configurations
  • cpe:2.3:a:djangoproject:django:0.91:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:0.91:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:0.95:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:0.95:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:0.95.1:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:0.95.1:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:0.96:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:0.96:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2.1:2:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2.1:2:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.0:alpha1:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.0:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.0:alpha2:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.0:alpha2:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.0:beta:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.0:beta:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.1:alpha1:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.1:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.1:beta1:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.1:beta1:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.1:rc1:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.1:rc1:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2:beta1:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2:beta1:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2:rc1:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2:rc1:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2-alpha1:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2-alpha1:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:djangoproject:django:1.3:alpha2:*:*:*:*:*:*
    cpe:2.3:a:djangoproject:django:1.3:alpha2:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 18-01-2018 - 02:29)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
refmap via4
confirm
debian DSA-2332
mlist
  • [oss-security] 20110911 CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws
  • [oss-security] 20110913 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws
  • [oss-security] 20110916 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws
secunia 46614
suse openSUSE-SU-2012:0653
Last major update 18-01-2018 - 02:29
Published 19-10-2011 - 10:55
Last modified 18-01-2018 - 02:29
Back to Top