Fluid Attacks Database

Description

Django data leakage via querystring manipulation in admin The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	django	>=0 <1.4.14 \|\| >=1.5 <1.5.9 \|\| >=1.6 <1.6.6 \|\| >=1.7a1 <1.7c3	1.4.14, 1.5.9, 1.6.6, 1.7c3
debian 12	python-django	>=0 <1.6.6-1	1.6.6-1
debian 13	python-django	>=0 <1.6.6-1	1.6.6-1
debian 14	python-django	>=0 <1.6.6-1	1.6.6-1
debian 11	python-django	>=0 <1.6.6-1	1.6.6-1

Aliases

1. CVE-2014-04832. NVD-2014-04833. OSV-2014-04834. OSV-DEBIAN-2014-04835. GCVE-2014-04836. SECURITY-TRACKER-CVE-2014-0483

References

1. https://github.com/django/django/commit/027bd348642007617518379f8b02546abacaa6e02. https://github.com/django/django/commit/2a446c896e7c814661fb9c4f212b071b2a7fa4463. https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a64. https://github.com/django/django/commit/f7c494f2506250b8cb5923714360a3642ed63e0f5. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-7.yaml6. https://www.djangoproject.com/weblog/2014/aug/20/security7. http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html8. http://www.debian.org/security/2014/dsa-3010

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.