~ / search / GHSA-rw75-m7gp-92m3

GHSA-rw75-m7gp-92m3

Django data leakage via querystring manipulation in admin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-0483

Packages

EcosystemPackageAffectedFixed in
PyPI Django < 1.4.14 1.4.14
PyPI Django >= 1.5, < 1.5.9 1.5.9
PyPI Django >= 1.6, < 1.6.6 1.6.6
PyPI Django >= 1.7a1, < 1.7c3 1.7c3

Details

As written in the advisory (Markdown source, shown as plain text).

The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a `/admin/auth/user/?pop=1&t=password` URI.

References

External links from the advisory. They lead to third-party sites.