GitHub Advisoryadvisory · PyPI

GHSA-6wcr-wcqm-3mfh Django settings leak in date template filter

MEDIUM Published 2022-05-17 Modified 2024-09-18 Official page ↗
Aliases
CVE-2015-8213
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-03-08

Affected packages

• PyPI Django: >= 1.7, < 1.7.11 → fixed in 1.7.11 • PyPI Django: >= 1.8a1, < 1.8.7 → fixed in 1.8.7 • PyPI Django: >= 1.9a1, < 1.9rc2 → fixed in 1.9rc2

Description

The get_format function in `utils/formats.py` in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by `SECRET_KEY`.

Related

Alias · CVE (1)

  • CVE-2015-8213 The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References