PT-2025-23006 · Unknown · Django-Select2

Neartik · Published 2025-05-27 · Updated 2025-05-28 · CVE-2025-48383

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Django-Select2 versions prior to 8.4.1

Description The issue affects instances of HeavySelect2Mixin subclasses, such as the ModelSelect2MultipleWidget and ModelSelect2Widget, allowing secret access tokens to leak across requests. This can enable users to access restricted query sets and data.

Recommendations For versions prior to 8.4.1, update to version 8.4.1 to resolve the issue. As a temporary workaround, consider restricting access to instances of HeavySelect2Mixin subclasses until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-402

CWE-918

Related Identifiers

CVE-2025-48383

GHSA-WJRH-HJ83-3WH7

Affected Products

Django-Select2

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48383.json · Exploit
• https://ubuntu.com/security/CVE-2025-48383 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-48383 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjrh-hj83-3wh7 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48383 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-48383 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48383 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48383 · Vendor Advisory
• https://github.com/codingjoe/django-select2/security/advisories/GHSA-wjrh-hj83-3wh7 · Note
• https://github.com/codingjoe/django-select2/commit/e5f41e6edba004d35f94915ff5e2559f44853412 · Note
• https://github.com/codingjoe/django-select2 · Note
• https://t.me/latest_high_impact_cve/2475 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1927424880477184286 · Twitter Post
• https://t.me/cvetracker/24737 · Telegram Post