Safety vulnerability ID: 35516
The information on this page was manually curated by our Cybersecurity Intelligence Team.
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI. See: CVE-2014-0483.
Latest version: 5.0.4
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.
CONFIRM:https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6: https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6
CONFIRM:https://www.djangoproject.com/weblog/2014/aug/20/security/: https://www.djangoproject.com/weblog/2014/aug/20/security/
DEBIAN:DSA-3010: http://www.debian.org/security/2014/dsa-3010
SUSE:openSUSE-SU-2014:1132: http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
SECUNIA:59782: http://secunia.com/advisories/59782
SECUNIA:61276: http://secunia.com/advisories/61276
SECUNIA:61281: http://secunia.com/advisories/61281
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application