PT-2014-3651 · Django Software Foundation+1 · Django+1

Collin Anderson · Publicado 2014-08-26 · Atualizado 2022-05-14 · CVE-2014-0483

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.13 Django versions 1.5.x through 1.5.8 Django versions 1.6.x through 1.6.5 Django versions 1.7 before release candidate 3

Description The administrative interface in Django does not check if a field represents a relationship between models. This allows remote authenticated users to obtain sensitive information via a to field parameter in a popup action to an admin change form page, as demonstrated by a "/admin/auth/user/?pop=1&t=password" URI.

Recommendations For Django versions 1.4.x through 1.4.13, update to version 1.4.14 or later. For Django versions 1.5.x through 1.5.8, update to version 1.5.9 or later. For Django versions 1.6.x through 1.6.5, update to version 1.6.6 or later. For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-264

Identificadores relacionados

CVE-2014-0483

DLA-65-1

DSA-3010-1

GHSA-RW75-M7GP-92M3

MGASA-2014-0366

PYSEC-2014-7

SUSE-SU-2015:0563-1

SUSE-SU-2015:0695-1

USN-2347-1

Produtos afetados

Django

Ubuntu

Referências · 32

• 🔥 https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6 · Exploit
• https://github.com/django/django · Nota
• https://github.com/django/django/commit/027bd348642007617518379f8b02546abacaa6e0 · Nota
• https://github.com/django/django/commit/2a446c896e7c814661fb9c4f212b071b2a7fa446 · Nota
• https://github.com/django/django/commit/f7c494f2506250b8cb5923714360a3642ed63e0f · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-7.yaml · Nota
• https://osv.dev/vulnerability/USN-2347-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rw75-m7gp-92m3 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0483 · Aviso do Fabricante
• https://djangoproject.com/weblog/2014/aug/20/security · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2347-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0366.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-0483 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-0480 · Aviso do Fabricante