PT-2020-14292 · Django+1 · Django Filer+1
Marcin Waraksa
·
Published
2020-09-28
·
Updated
2025-10-14
·
CVE-2020-15225
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
django-filter versions prior to 2.4.0
Description
The issue concerns automatically generated
NumberFilter instances in django-filter, which are subject to potential Denial of Service (DoS) attacks from malicious input using exponential format with sufficiently large exponents. This occurs when the value is later converted to an integer. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.Recommendations
For versions prior to 2.4.0, consider upgrading to version 2.4.0 or later, which applies a
MaxValueValidator with a default limit value of 1e50 to the form field used by NumberFilter instances.
As a temporary workaround, users may manually apply an equivalent validator if they are not able to upgrade.
Additionally, NumberFilter implements the new get max validator() which should return a configured validator instance to customise the limit, or else None to disable the additional validation.Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Django Filer