CVE-2012-4520: Djangoproject Django

Medium severity, CVSS 6.4. EPSS: 3.7% chance of exploitation in the next 30 days.

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Affected products

• Djangoproject Django: version 1.3 only; version 1.3.1 only; version 1.3.2 only; version 1.3.3 only; version 1.4 only; version 1.4.1 only

Published 2012-11-18. Last modified 2026-06-16.