Information Disclosure Through Date Template Filter

2019-01-1509:10:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Django is vulnerable to information disclosure. This vulnerability is caused in the get_format function in utils/formats.py which allows a malicious user to obtain any secret in the application settings by specifying a settings key name instead of a date format.

CPENameOperatorVersion
python-djangoeq1.6.11__3.el6ost
python-djangoeq1.6.11__2.el7ost
python-djangoeq1.8.3__1.el7
python-djangoeq1.8.4__1.el7
python-djangoeq1.6.5__1.el7
python-djangoeq1.6.5__2.el6ost
python-djangoeq1.6.11__1.el6ost
python-djangoeq1.6.11__3.el7ost

Name	Operator	Version
python-django	eq	1.6.11__3.el6ost
python-django	eq	1.6.11__2.el7ost
python-django	eq	1.8.3__1.el7
python-django	eq	1.8.4__1.el7
python-django	eq	1.6.5__1.el7
python-django	eq	1.6.5__2.el6ost
python-django	eq	1.6.11__1.el6ost
python-django	eq	1.6.11__3.el7ost