CVE-2014-0472

CVE-2014-0472 describes a critical vulnerability in the Django web framework (versions prior to 1.4.11, 1.5.6, 1.6.3, and 1.7 beta 2) that allows remote attackers to import and execute arbitrary Python modules. This occurs when a Django view constructs URLs using user-supplied input and a "dotted Python path," impacting canonical and djangoproject Django installations. The vulnerability has a CVSS score of 5.1, indicating a medium severity. It requires high attack complexity (AC:H) but can be exploited remotely (AV:N) without authentication (Au:N), potentially leading to partial confidentiality, integrity, and availability compromise (C:P/I:P/A:P). Despite its potential impact, there is no evidence of active exploitation (KEV: No), nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has also received minimal community discussion and media coverage, suggesting low awareness and limited current threat activity.