GitHub Advisoryadvisory · PyPI

GHSA-8c5j-9r9f-c6w8 Information disclosure in Django

HIGH Published 2022-01-12 Modified 2024-09-20 Official page ↗
Aliases
CVE-2021-45116
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20
Reviewed
2022-01-12

Affected packages

• PyPI Django: >= 2.2, < 2.2.26 → fixed in 2.2.26 • PyPI Django: >= 3.2, < 3.2.11 → fixed in 3.2.11 • PyPI Django: >= 4.0, < 4.0.1 → fixed in 4.0.1

Description

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.

Related

Alias · CVE (1)

  • CVE-2021-45116 An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References