CVE-2013-0305

2013-02-2000:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS

0.001

Percentile

48.5%

JSON

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before
1.4.4, and 1.5 before release candidate 2 does not check permissions for
the history view, which allows remote authenticated administrators to
obtain sensitive object history information.

Bugs

Notes

Author	Note
jdstrand	requires access to the admin interface

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchpython-django< 1.1.1-2ubuntu1.8UNKNOWN
ubuntu11.10noarchpython-django< 1.3-2ubuntu1.6UNKNOWN
ubuntu12.04noarchpython-django< 1.3.1-4ubuntu1.6UNKNOWN
ubuntu12.10noarchpython-django< 1.4.1-2ubuntu0.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	python-django	< 1.1.1-2ubuntu1.8	UNKNOWN
ubuntu	11.10	noarch	python-django	< 1.3-2ubuntu1.6	UNKNOWN
ubuntu	12.04	noarch	python-django	< 1.3.1-4ubuntu1.6	UNKNOWN
ubuntu	12.10	noarch	python-django	< 1.4.1-2ubuntu0.3	UNKNOWN