Vulnerability in Djangoproject Django
CVE-2010-4534
The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.0 (Medium). Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.025 (84.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: 0.000
Affected products
- Djangoproject Django — versions 0.91, 0.95, 0.95.1
Weakness classification (CWE)
References
- www.securityfocus.com/bid/45562 (vdb-entry)
- ngenuity-is.com/advisories/2010/dec/22/information-leakage-in-django-administra… (Exploit)
- www.openwall.com/lists/oss-security/2010/12/23/4 (mailing-list, Patch)
- www.securityfocus.com/archive/1/515446 (mailing-list)
- www.ubuntu.com/usn/USN-1040-1 (vendor-advisory)
- www.openwall.com/lists/oss-security/2011/01/03/5 (mailing-list, Patch)
- secunia.com/advisories/42913 (third-party-advisory)
- evilpacket.net/2010/dec/22/information-leakage-django-administrative-interfac/ (Exploit)
- code.djangoproject.com/changeset/15031 (Patch)
- www.vupen.com/english/advisories/2011/0048 (vdb-entry)