PT-2014-3651 · Django Software Foundation+1 · Django+1

Collin Anderson · Published 2014-08-26 · Updated 2022-05-14 · CVE-2014-0483

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.13 Django versions 1.5.x through 1.5.8 Django versions 1.6.x through 1.6.5 Django versions 1.7 before release candidate 3

Description The administrative interface in Django does not check if a field represents a relationship between models. This allows remote authenticated users to obtain sensitive information via a to field parameter in a popup action to an admin change form page, as demonstrated by a "/admin/auth/user/?pop=1&t=password" URI.

Recommendations For Django versions 1.4.x through 1.4.13, update to version 1.4.14 or later. For Django versions 1.5.x through 1.5.8, update to version 1.5.9 or later. For Django versions 1.6.x through 1.6.5, update to version 1.6.6 or later. For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-264

Related Identifiers

CVE-2014-0483

DLA-65-1

DSA-3010-1

GHSA-RW75-M7GP-92M3

MGASA-2014-0366

PYSEC-2014-7

SUSE-SU-2015:0563-1

SUSE-SU-2015:0695-1

USN-2347-1

Affected Products

Django

Ubuntu

References · 32

• 🔥 https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6 · Exploit
• https://osv.dev/vulnerability/USN-2347-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rw75-m7gp-92m3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0483 · Vendor Advisory
• https://djangoproject.com/weblog/2014/aug/20/security · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2347-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0366.html · Security Note
• https://ubuntu.com/security/CVE-2014-0483 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0480 · Vendor Advisory
• http://debian.org/security/2014/dsa-3010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0483 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0366 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0481 · Vendor Advisory