CVE-2014-0474: Django - Type Conversion Vulnerability
Summary
CVE-2014-0474: Django Vulnerable to MySQL Injection. Affects django across 3 version ranges.
< 1.4.11
>= 1.5, < 1.5.6
>= 1.6, < 1.6.3
Fixed in 1.4.11, 1.5.6 or 1.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2014-0474 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a set of tools and libraries for handling various web-related tasks, such as URL routing, database management, and template rendering. Django is widely used in the industry and has a large community of developers.
Vulnerability Detail
The vulnerability identified as CVE-2014-0474 affects Django versions before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2. It specifically impacts the following model field classes: FilePathField, GenericIPAddressField, and IPAddressField. These classes do not perform proper type conversion, leading to potential security issues related to 'MySQL typecasting.' The exact impact and vectors of this vulnerability are unspecified.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.111.4.11pip install --upgrade "django==1.4.11" -
>= 1.5, < 1.5.61.5.6pip install --upgrade "django==1.5.6" -
>= 1.6, < 1.6.31.6.3pip install --upgrade "django==1.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by upgrading Django to the patched versions.
Conclusion
The vulnerability in Django versions before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2, affecting the FilePathField, GenericIPAddressField, and IPAddressField model field classes, can be addressed by upgrading Django to the recommended versions. It is crucial to keep software up to date to mitigate potential security risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies web application development.
Django versions before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 are affected.
The exact impact of this vulnerability is unspecified. It could potentially allow remote attackers to exploit the affected model field classes in Django.
To fix this vulnerability, upgrade Django to version 1.4.11, 1.5.6, 1.6.3, or later.
No specific workaround is mentioned. It is recommended to apply the fix by upgrading Django.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
