PT-2013-2219 · Django · Django

Orange Tsai · Publicado 2013-05-02 · Atualizado 2022-05-05 · CVE-2013-0305

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.3.x through 1.3.5 Django versions 1.4.x through 1.4.3 Django versions 1.5 before release candidate 2

Description The administrative interface does not check permissions for the history view, allowing remote authenticated administrators to obtain sensitive object history information.

Recommendations For Django versions 1.3.x through 1.3.5, update to version 1.3.6 or later. For Django versions 1.4.x through 1.4.3, update to version 1.4.4 or later. For Django versions 1.5 before release candidate 2, update to release candidate 2 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-0305

DSA-2634-1

GHSA-R7W6-P47G-VJ53

PYSEC-2013-16

RHSA-2013:0670

Produtos afetados

Django

Referências · 14

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/0e7861aec73702f7933ce2a93056f7983939f0d6 · Nota
• https://github.com/django/django/commit/d3a45e10c8ac8268899999129daa27652ec0da35 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2013-16.yaml · Nota
• https://djangoproject.com/weblog/2013/feb/19/security · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1757-1 · Aviso do Fabricante
• http://debian.org/security/2013/dsa-2634 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2013-16 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0305 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-0670.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r7w6-p47g-vj53 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-0305 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2013-0305 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-0305 · Aviso do Fabricante