Information Disclosure Through Date Template Filter

2019-01-1509:10:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.007 Low

EPSS

Percentile

80.8%

JSON

Django is vulnerable to information disclosure. This vulnerability is caused in the get_format function in utils/formats.py which allows a malicious user to obtain any secret in the application settings by specifying a settings key name instead of a date format.

CPENameOperatorVersion
python-djangoeq1.6.11__3.el6ost
python-djangoeq1.6.11__2.el7ost
python-djangoeq1.8.3__1.el7
python-djangoeq1.8.4__1.el7
python-djangoeq1.6.5__1.el7
python-djangoeq1.6.5__2.el6ost
python-djangoeq1.6.11__1.el6ost
python-djangoeq1.6.11__3.el7ost

Name	Operator	Version
python-django	eq	1.6.11__3.el6ost
python-django	eq	1.6.11__2.el7ost
python-django	eq	1.8.3__1.el7
python-django	eq	1.8.4__1.el7
python-django	eq	1.6.5__1.el7
python-django	eq	1.6.5__2.el6ost
python-django	eq	1.6.11__1.el6ost
python-django	eq	1.6.11__3.el7ost