Lucene search
Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-7D095365F7951016B48FBAE4DE71AFBFHistoryDec 07, 2015 - 12:00 a.m.
Settings leak in date template filter
2015-12-0700:00:00
https://gitlab.com/gitlab-org/security-products/gemnasium-db
gitlab.com
8
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.007 Low
EPSS
Percentile
77.9%
If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, a malicious user could obtain any secret in the application’s settings by specifying a settings key instead of a date format. e.g. SECRET_KEY instead of j/m/Y.
| CPE | Name | Operator | Version |
|---|---|---|---|
| pypi/django | lt | 1.7.11 | |
| pypi/django | ge | 1.8.0a | |
| pypi/django | lt | 1.8.7 | |
| pypi/django | ge | 1.9a | |
| pypi/django | lt | 1.9rc2 |
Related
altlinux
altlinux
redhat
redhat
(RHSA-2016:0360) Moderate: python-django security update
2016-03-08 06:31:21
(RHSA-2016:0157) Moderate: python-django security update
2016-02-10 01:06:18
(RHSA-2016:0156) Moderate: python-django security update
2016-02-10 01:06:15
nessus
nessus
FreeBSD : django -- information leak vulnerability (11c52bc6-97aa-11e5-b8df-14dae9d210b8)
2015-12-01 00:00:00
openSUSE Security Update : python-django (openSUSE-2015-860)
2015-12-17 00:00:00
Debian DLA-349-1 : python-django security update
2015-11-30 00:00:00
debiancve
debiancve
CVE-2015-8213
2015-12-07 20:59:00
osv
osv
Django settings leak in date template filter
2022-05-17 03:25:24
PYSEC-2015-11
2015-12-07 20:59:00
openvas
openvas
Debian Security Advisory DSA 3404-1 (python-django - security update)
2015-11-25 00:00:00
Mageia Linux Local Check: mgasa-2015-0463
2015-12-08 00:00:00
Debian Security Advisory DSA 3404-1 (python-django - security update)
2015-11-25 00:00:00
freebsd
freebsd
django -- information leak vulnerability
2015-11-24 00:00:00
debian
debian
[SECURITY] [DSA 3404-1] python-django security update
2015-11-25 17:32:31
[SECURITY] [DSA 3404-1] python-django security update
2015-11-25 17:32:31
[SECURITY] [DLA 349-1] python-django security update
2015-11-25 21:40:45
github
github
Django settings leak in date template filter
2022-05-17 03:25:24
mageia
mageia
Updated python-django packages fix security vulnerability
2015-12-05 02:31:36
veracode
veracode
Information Disclosure Through Date Template Filter
2019-01-15 09:10:00
archlinux
archlinux
python-django, python2-django: information leakage
2015-12-05 00:00:00
fedora
fedora
[SECURITY] Fedora 23 Update: python-django-1.8.7-1.fc23
2015-12-07 20:32:33
[SECURITY] Fedora 22 Update: python-django-1.8.7-1.fc22
2015-12-31 01:53:36
prion
prion
Format string
2015-12-07 20:59:00
cve
cve
CVE-2015-8213
2015-12-07 20:59:00
ubuntucve
ubuntucve
CVE-2015-8213
2015-11-24 00:00:00
ubuntu
ubuntu
Django vulnerability
2015-11-24 00:00:00
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.007 Low
EPSS
Percentile
77.9%
Related for GITLAB-7D095365F7951016B48FBAE4DE71AFBF