CVE-2018-14574

45

FAUCET Score

CVE-2018-14574 describes an Open Redirect vulnerability in Django's CommonMiddleware, affecting Django versions 1.11.x before 1.11.15 and 2.0.x before 2.0.8, including various Canonical and Debian distributions. Rated 6.1 MEDIUM, this vulnerability allows an unauthenticated attacker to redirect users to arbitrary malicious sites with low attack complexity, potentially leading to phishing or credential theft. While there is no evidence of active exploitation or public exploit code like Metasploit or ExploitDB entries, a Nuclei template exists for detection, and there is minimal community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.11, < 1.11.15CPE matchmatch criteria	cpe:2.3:a:djangoproject:django::::::::
		>= 2.0, < 2.0.8CPE matchmatch criteria	cpe:2.3:a:djangoproject:django::::::::
		9.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:9.0:::::::*
		18.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:18.04:::::::*

CVSS Data

CVSS version used by this source: 3.0

6.1MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

2.8

Impact Score

2.7

CvssVersion

3.0

Exploit Intelligence

EPSS Score

25.49%

Probability of exploitation in next 30 days

EPSS Percentile

97.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

Nuclei: CVE-2018-14574 · Jun 18, 2020

This CVE's current EPSS score of 0.2549 is in the 99th percentile among its peer group of 26,236 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (24)

pippatch availablevia ghsa

Product: djangoFixed in: 2.0.8

pippatch availablevia ghsa

Product: DjangoFixed in: 1.11.15

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: graphite-web-0:1.1.4-1.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: python-cachetools-0:1.0.3-1.1.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: python-carbon-0:1.1.4-1.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: python-django-0:1.11.15-4.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: python-django-tagging-0:0.4.6-1.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: python-scandir-0:1.3-1.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: python-whisper-0:1.1.4-1.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: tendrl-ansible-0:1.6.3-11.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: tendrl-api-0:1.6.3-10.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: tendrl-commons-0:1.6.3-15.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: tendrl-monitoring-integration-0:1.6.3-20.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: tendrl-node-agent-0:1.6.3-15.el7rhgs

redhatpatch availablevia redhat_api

Product: Red Hat Gluster Storage 3.4 for RHEL 7Fixed in: tendrl-selinux-0:1.5.4-3.el7rhgs

redhatend of lifevia redhat_api

Product: Red Hat Ceph Storage 2Fixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat Ceph Storage 3Fixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat OpenStack Platform 10 (Newton)Fixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat OpenStack Platform 13 (Queens)Fixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat OpenStack Platform 8 (Liberty)Fixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat OpenStack Platform 8 (Liberty) Operational ToolsFixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat OpenStack Platform 9 (Mitaka)Fixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat OpenStack Platform 9 (Mitaka) Operational ToolsFixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat Subscription Asset ManagerFixed in: Django

Vendor Advisories (2)

pipGHSA-5hg3-6c2f-f3wrmedium

Django open redirect

redhatCVE-2018-14574Moderate

django: Open redirect possibility in CommonMiddleware

References

access.redhat.com / errata/RHSA-2019:0265

Third Party Advisory

usn.ubuntu.com / 3726-1

Third Party Advisory

debian.org / security/2018/dsa-4264

Third Party Advisory

djangoproject.com / weblog/2018/aug/01/security-releases

PatchVendor Advisory

securityfocus.com / bid/104970

Third Party AdvisoryVDB Entry

securitytracker.com / id/1041403

Third Party AdvisoryVDB Entry