PT-2025-23836 · Django+5 · Django+5
Seokchan Yoon
·
Publicado
2025-06-04
·
Atualizado
2026-01-15
·
CVE-2025-48432
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.22
Django versions 5.1 through 5.1.10
Django versions 5.2 through 5.2.2
Description
An issue was discovered in Django where internal HTTP response logging does not escape
request.path, allowing remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems. Approximately 1,696,617 results are found to be potentially affected.Recommendations
For Django version 4.2, update to version 4.2.22 or later.
For Django version 5.1, update to version 5.1.10 or later.
For Django version 5.2, update to version 5.2.2 or later.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Debian
Django
Linuxmint
Red Os
Ubuntu