CVE-2011-4137
Estado: ModificadaMedia (5)—
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
- Puntuación base: 5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 3.02%
- Percentil entre todas las CVEs puntuadas: 87
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-399
Referencias
- http://openwall.com/lists/oss-security/2011/09/11/1
- http://openwall.com/lists/oss-security/2011/09/13/2
- http://openwall.com/lists/oss-security/2011/09/15/5
- http://secunia.com/advisories/46614
- http://www.debian.org/security/2011/dsa-2332
- https://bugzilla.redhat.com/show_bug.cgi?id=737366
- https://hermes.opensuse.org/messages/14700881
- https://www.djangoproject.com/weblog/2011/sep/09/
- https://www.djangoproject.com/weblog/2011/sep/10/127/
- http://openwall.com/lists/oss-security/2011/09/11/1
- http://openwall.com/lists/oss-security/2011/09/13/2
- http://openwall.com/lists/oss-security/2011/09/15/5
- http://secunia.com/advisories/46614
- http://www.debian.org/security/2011/dsa-2332
- https://bugzilla.redhat.com/show_bug.cgi?id=737366
- https://hermes.opensuse.org/messages/14700881
- https://www.djangoproject.com/weblog/2011/sep/09/
- https://www.djangoproject.com/weblog/2011/sep/10/127/
JSON original (NVD)
Mostrar
{
"id": "CVE-2011-4137",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2011-10-19T10:55:04.207",
"references": [
{
"url": "http://openwall.com/lists/oss-security/2011/09/11/1",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/13/2",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/15/5",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/46614",
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2011/dsa-2332",
"source": "cve@mitre.org"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737366",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "https://hermes.opensuse.org/messages/14700881",
"source": "cve@mitre.org"
},
{
"url": "https://www.djangoproject.com/weblog/2011/sep/09/",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.djangoproject.com/weblog/2011/sep/10/127/",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/11/1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/13/2",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://openwall.com/lists/oss-security/2011/09/15/5",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/46614",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2011/dsa-2332",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737366",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://hermes.opensuse.org/messages/14700881",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.djangoproject.com/weblog/2011/sep/09/",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.djangoproject.com/weblog/2011/sep/10/127/",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-399"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521."
},
{
"lang": "es",
"value": "La funcionalidad verify_exists de la implementación de URLField en Django en versiones anteriores a 1.2.7 y 1.3.x anteriores a 1.3.1 se basa en librerías Python que tratan de acceder a URLs arbitrarias sin un temporizador, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de todos los recursos) a través de una URL asociada con (1) una respuesta lenta, (2) una conexión TCP completa sin datos enviados o (3) una gran cantidad de datos de aplicación. Un problema relacionado con CVE-2011-1521."
}
],
"lastModified": "2026-06-16T23:34:29.663",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96EC0AAD-1199-4CDB-B599-A7959A160CB6",
"versionEndIncluding": "1.2.6"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:0.91:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C40AD94B-AC89-4404-973F-5E60468D06EA"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:0.95:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "529CD787-1C98-4F20-8A3D-90BF2B0BD790"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:0.95.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65A952FB-3A74-4A39-8870-1F37059C9D12"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:0.96:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E79CFED-F8BF-48E7-897D-D1FB508DC9E1"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9023348-07A7-46E8-B45A-CC19563C5961"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "883C9BEA-8B02-42F7-90BB-F31CBCBF8B1E"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59302184-7805-4D50-B25C-73E59DAA1E66"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56846659-96C8-497C-8404-3975E5B6385B"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2DAB4639-B81D-412A-A081-EFF46737CA5D"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF068CD9-B33A-4C51-9FBA-CFDAE91E174E"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26D338D9-1504-4933-B833-BD7F1864E89D"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD257D91-EF31-4103-9007-944603ABA271"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99387F31-9E04-4A73-A1C6-C05F96A8DB38"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.1:2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F75FE4BB-2C64-404F-9347-25289556BE56"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "064C9403-8A43-42C7-A1FD-03CC49A32FB1"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BCDB95B-88F2-466A-A4F9-4C080183E39B"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17B99C62-A653-45C1-A061-05A8FAD52107"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFA5071B-808F-490E-B407-37CD24ACCA47"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F5428AE-6B63-4D27-BCC4-F228264A6F0E"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06F122AC-B9BF-4E27-A7C0-F3E7B5E8A907"
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.3:alpha2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF1504F2-968F-4E1A-A143-BE494E658DF0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}