PyPI: django
CVE-2013-0305
Safety vulnerability ID: SFTY-20130502-73492
Safety legacy ID: pyup.io-33111
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
Overview
Django Data leakage via admin history log
Advisory
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20130502-73492/CVE-2013-0305
- https://nvd.nist.gov/vuln/detail/CVE-2013-0305
- http://rhn.redhat.com/errata/RHSA-2013-0670.html
- http://ubuntu.com/usn/usn-1757-1
- http://www.debian.org/security/2013/dsa-2634
- https://github.com/django/django/commit/0e7861aec73702f7933ce2a93056f7983939f0d6
- https://github.com/django/django/commit/d3a45e10c8ac8268899999129daa27652ec0da35
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2013-16.yaml
- https://www.djangoproject.com/weblog/2013/feb/19/security
- https://github.com/advisories/GHSA-r7w6-p47g-vj53
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more