CVEvulnerability
CVE-2021-45116
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-01-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-20
Description
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
Affected configurations
• djangoproject django (>= 2.2 < 2.2.26)
• djangoproject django (>= 3.2 < 3.2.11)
• djangoproject django (>= 4.0 < 4.0.1)
• fedoraproject fedora 35
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://docs.djangoproject.com/en/4.0/releases/security/ Patch, Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20220121-0005/ Third Party Advisory
- https://www.djangoproject.com/weblog/2022/jan/04/security-releases/ Patch, Vendor Advisory
- https://docs.djangoproject.com/en/4.0/releases/security/ Patch, Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20220121-0005/ Third Party Advisory
- https://www.djangoproject.com/weblog/2022/jan/04/security-releases/ Patch, Vendor Advisory