CVE-2014-0483

Django <1.4.14, 1.5.x <1.5.9, 1.6.x <1.6.6, 1.7 - Info Disclosure

Title source: llm
STIX 2.1

Description

The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.

References (7)

Core 7
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61276
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61281
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3010
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59782

Scores

EPSS 0.0198
EPSS Percentile 78.3%

Details

CWE
CWE-264
Status published
Products (32)
djangoproject/django 1.5 (3 CPE variants)
djangoproject/django 1.5.1
djangoproject/django 1.5.2
djangoproject/django 1.5.3
djangoproject/django 1.5.4
djangoproject/django 1.5.5
djangoproject/django 1.5.6
djangoproject/django 1.5.7
djangoproject/django 1.5.8
djangoproject/django 1.6 (5 CPE variants)
... and 22 more
Published Aug 26, 2014
Tracked Since Feb 18, 2026