GitHub Advisoryadvisory · PyPI

GHSA-r7w6-p47g-vj53 Django Data leakage via admin history log

MEDIUM Published 2022-05-05 Modified 2024-09-18 Official page ↗
Aliases
CVE-2013-0305
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-17

Affected packages

• PyPI Django: >= 1.3, < 1.3.6 → fixed in 1.3.6 • PyPI Django: >= 1.4, < 1.4.4 → fixed in 1.4.4

Description

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.

Related

Alias · CVE (1)

  • CVE-2013-0305 The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References