GitHub Advisory DatabaseGHSA-8C5J-9R9F-C6W8Information disclosure in Django
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
56.1%
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language’s variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
Affected configurations
References
docs.djangoproject.com/en/4.0/releases/security
github.com/advisories/GHSA-8c5j-9r9f-c6w8
github.com/django/django/commit/2a8ec7f546d6d5806e221ec948c5146b55bd7489
github.com/django/django/commit/c7fe895bca06daf12cc1670b56eaf72a1ef27a16
github.com/django/django/commit/c9f648ccfac5ab90fb2829a66da4f77e68c7f93a
github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-2.yaml
groups.google.com/forum/#!forum/django-announce
lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
nvd.nist.gov/vuln/detail/CVE-2021-45116
security.netapp.com/advisory/ntap-20220121-0005
www.djangoproject.com/weblog/2022/jan/04/security-releases
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
56.1%