CVE-2022-36359

HIGH

Django 3.2-3.2.15 and 4.0-4.0.7 - Reflected File Download via User-Supplied Filename in FileResponse

Title source: llm
STIX 2.1

Description

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

References (8)

Core 8
Core References
Not Applicable, Patch, Vendor Advisory
https://docs.djangoproject.com/en/4.0/releases/security/
Release Notes, Third Party Advisory
https://groups.google.com/g/django-announce/c/8cz--gvaJr4
Mailing List, Patch, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2022/08/03/1
Third Party Advisory vendor-advisory
https://www.debian.org/security/2022/dsa-5254

Scores

CVSS v3 8.8
EPSS 0.0065
EPSS Percentile 46.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-494
Status published
Products (3)
debian/debian_linux 11.0
djangoproject/django 3.2 - 3.2.15
pypi/Django 0 - 3.2.15PyPI
Published Aug 03, 2022
Tracked Since Feb 18, 2026