PT-2013-2219 · Django · Django

Orange Tsai · Published 2013-05-02 · Updated 2022-05-05 · CVE-2013-0305

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.3.x through 1.3.5 Django versions 1.4.x through 1.4.3 Django versions 1.5 before release candidate 2

Description The administrative interface does not check permissions for the history view, allowing remote authenticated administrators to obtain sensitive object history information.

Recommendations For Django versions 1.3.x through 1.3.5, update to version 1.3.6 or later. For Django versions 1.4.x through 1.4.3, update to version 1.4.4 or later. For Django versions 1.5 before release candidate 2, update to release candidate 2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-0305

DSA-2634-1

GHSA-R7W6-P47G-VJ53

PYSEC-2013-16

RHSA-2013:0670

Affected Products

Django

References · 14

• https://djangoproject.com/weblog/2013/feb/19/security · Vendor Advisory
• http://ubuntu.com/usn/usn-1757-1 · Vendor Advisory
• http://debian.org/security/2013/dsa-2634 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-16 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0305 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0670.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7w6-p47g-vj53 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0305 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-0305 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-0305 · Vendor Advisory
• https://github.com/django/django · Note
• https://github.com/django/django/commit/0e7861aec73702f7933ce2a93056f7983939f0d6 · Note
• https://github.com/django/django/commit/d3a45e10c8ac8268899999129daa27652ec0da35 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2013-16.yaml · Note