Lucene search

K
osvGoogleOSV:GHSA-R7W6-P47G-VJ53
HistoryMay 05, 2022 - 2:48 a.m.

Django Data leakage via admin history log

2022-05-0502:48:46
Google
osv.dev
8
django
data leakage
admin interface

EPSS

0.001

Percentile

48.5%

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.