HIGH
Django: Host header poisoning vulnerability
Published Nov 18, 2012
8.7
HIGHCVSS 4.0
EPSS 3.67%
Description
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
Affected products
No data.
Configuration 1
OR
- 1.3
- 1.3
- 1.3
- 1.3.1
- 1.3.2
- 1.3.3
Configuration 2
OR
- 1.4
- 1.4.1
No data.
Red Hat Subscription Asset Manager
Django
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Subscription Asset Manager | Django | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
8.7 HIGH GHSA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required None
User Interaction None
Vulnerable System Confidentiality None
Vulnerable System Integrity High
Vulnerable System Availability None
Subsequent System Confidentiality None
Subsequent System Integrity None
Subsequent System Availability None
7.5 HIGH GHSA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact High
Availability Impact None
No CVSS v3.0 score for this CVE.
6.4 MEDIUM NVD
AV:N/AC:L/Au:N/C:P/I:P/A:N
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
3.67% 0.03665
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.03665
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (11 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 3.67% (0.03665) | 89.28th | v5 (v2026.06.15) |
| Jun 15, 2026 | 3.64% (0.03635) | 88.04th | v5 (v2026.06.15) |
| Mar 30, 2025 | 4.44% (0.04443) | 88.00th | v4 (v2025.03.14) |
| Mar 29, 2025 | 3.19% (0.03190) | 78.17th | v4 (v2025.03.14) |
| Mar 17, 2025 | 4.44% (0.04443) | 88.30th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.67% (0.00670) | 80.46th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.67% (0.00670) | 79.15th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.67% (0.00670) | 76.63th | v3 (v2023.03.01) |
| Mar 6, 2023 | 3.78% (0.03779) | 85.48th | v2 (v2022.01.01) |
| Apr 1, 2022 | 3.78% (0.03779) | 84.01th | v2 (v2022.01.01) |
| Feb 4, 2022 | 3.78% (0.03779) | 67.21th | v2 (v2022.01.01) |
Weaknesses (1)
References (31)
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145 x_refsource_MISC
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090666.html vendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090904.html vendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.html vendor-advisoryx_refsource_FEDORA
- http://secunia.com/advisories/51033 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/51314 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://securitytracker.com/id?1027708 vdb-entryx_refsource_SECTRACK
- http://ubuntu.com/usn/usn-1632-1 vendor-advisoryx_refsource_UBUNTU
- http://ubuntu.com/usn/usn-1757-1 vendor-advisoryx_refsource_UBUNTU
- http://www.debian.org/security/2013/dsa-2634 vendor-advisoryx_refsource_DEBIAN
- http://www.openwall.com/lists/oss-security/2012/10/30/4 mailing-listx_refsource_MLIST
- http://www.osvdb.org/86493 vdb-entryx_refsource_OSVDB
- https://access.redhat.com/security/cve/CVE-2012-4520 Vendor Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145
- https://bugzilla.redhat.com/show_bug.cgi?id=865164 x_refsource_MISCIssue Tracking
- https://github.com/advisories/GHSA-2655-q453-22f9 Advisory
- https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3 x_refsource_CONFIRM
- https://github.com/django/django/commit/9305c0e12d43c4df999c3301a1f0c742264a657e x_refsource_CONFIRM
- https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071 x_refsource_CONFIRM
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2012-7.yaml
- https://lists.fedoraproject.org/pipermail/package-announce/2012-October/090666.html
- https://lists.fedoraproject.org/pipermail/package-announce/2012-October/090904.html
- https://lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.html
- https://nvd.nist.gov/vuln/detail/CVE-2012-4520
- https://ubuntu.com/usn/usn-1632-1
- https://ubuntu.com/usn/usn-1757-1
- https://web.archive.org/web/20140417023920/http://securitytracker.com/id?1027708
- https://www.cve.org/CVERecord?id=CVE-2012-4520
- https://www.debian.org/security/2013/dsa-2634
- https://www.djangoproject.com/weblog/2012/oct/17/security x_refsource_CONFIRMPatchVendor Advisory
- https://www.openwall.com/lists/oss-security/2012/10/30/4
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Nov 18, 2012
Updated Aug 6, 2024
Reserved Aug 21, 2012
Link CVE-2012-4520
CISA Vulnrichment
GHSA-2655-Q453-22F9 Updated n/a