django -- information leak vulnerability

2015-11-2400:00:00

vuxml.freebsd.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.007 Low

EPSS

Percentile

80.4%

JSON

Tim Graham reports:

If an application allows users to specify an unvalidated
format for dates and passes this format to the date filter, e.g. {{
last_updated|date:user_date_format }}, then a malicious user could
obtain any secret in the application’s settings by specifying a settings
key instead of a date format. e.g. “SECRET_KEY” instead of “j/m/Y”.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchpy27-django< 1.8.7UNKNOWN
FreeBSDanynoarchpy32-django< 1.8.7UNKNOWN
FreeBSDanynoarchpy33-django< 1.8.7UNKNOWN
FreeBSDanynoarchpy34-django< 1.8.7UNKNOWN
FreeBSDanynoarchpy27-django18< 1.8.7UNKNOWN
FreeBSDanynoarchpy32-django18< 1.8.7UNKNOWN
FreeBSDanynoarchpy33-django18< 1.8.7UNKNOWN
FreeBSDanynoarchpy34-django18< 1.8.7UNKNOWN
FreeBSDanynoarchpy27-django17< 1.7.11UNKNOWN
FreeBSDanynoarchpy32-django17< 1.7.11UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	py27-django	< 1.8.7	UNKNOWN
FreeBSD	any	noarch	py32-django	< 1.8.7	UNKNOWN
FreeBSD	any	noarch	py33-django	< 1.8.7	UNKNOWN
FreeBSD	any	noarch	py34-django	< 1.8.7	UNKNOWN
FreeBSD	any	noarch	py27-django18	< 1.8.7	UNKNOWN
FreeBSD	any	noarch	py32-django18	< 1.8.7	UNKNOWN
FreeBSD	any	noarch	py33-django18	< 1.8.7	UNKNOWN
FreeBSD	any	noarch	py34-django18	< 1.8.7	UNKNOWN
FreeBSD	any	noarch	py27-django17	< 1.7.11	UNKNOWN
FreeBSD	any	noarch	py32-django17	< 1.7.11	UNKNOWN