CVE-2018-14574: Open Redirect Vulnerability in Django
Summary
CVE-2018-14574: Django open redirect. Affects django across 2 version ranges.
>= 1.11, < 1.11.15
>= 2.0, < 2.0.8
Fixed in 1.11.15 or 2.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2018-14574 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a robust set of tools and features for developers to create secure and scalable websites. However, Django versions 1.11.x before 1.11.15 and 2.0.x before 2.0.8 are susceptible to an Open Redirect vulnerability.
Vulnerability Detail
The Open Redirect vulnerability in Django is found in the 'django.middleware.common.CommonMiddleware' component. This vulnerability allows an attacker to redirect users to malicious websites by manipulating the URL parameters. By exploiting this vulnerability, an attacker can trick users into visiting phishing sites or executing unintended actions.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.11, < 1.11.151.11.15pip install --upgrade "django==1.11.15" -
>= 2.0, < 2.0.82.0.8pip install --upgrade "django==2.0.8"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions mentioned above to mitigate the risk of exploitation.
Conclusion
In conclusion, the Open Redirect vulnerability in Django can be mitigated by upgrading to the fixed versions mentioned above. It is crucial to keep your Django installation up to date to ensure the security of your web applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
An Open Redirect vulnerability allows an attacker to redirect users to malicious websites by manipulating the URL parameters.
By exploiting this vulnerability, an attacker can trick users into visiting phishing sites or executing unintended actions.
Django versions 1.11.x before 1.11.15 and 2.0.x before 2.0.8 are affected.
To fix this vulnerability, upgrade Django to version 1.11.15 or higher for Django 1.11.x users, and version 2.0.8 or higher for Django 2.0.x users.
No, there is no known workaround. It is essential to upgrade to the fixed versions to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
