The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
21 Nov 2024, 02:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html - | |
| References | () http://secunia.com/advisories/59782 - | |
| References | () http://secunia.com/advisories/61276 - | |
| References | () http://secunia.com/advisories/61281 - | |
| References | () http://www.debian.org/security/2014/dsa-3010 - | |
| References | () https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6 - Exploit, Patch | |
| References | () https://www.djangoproject.com/weblog/2014/aug/20/security/ - Vendor Advisory |
Information
Published : 2014-08-26 14:55
Updated : 2024-11-21 02:02
NVD link : CVE-2014-0483
Mitre link : CVE-2014-0483
CVE.ORG link : CVE-2014-0483
JSON object : View
Products Affected
opensuse
- opensuse
djangoproject
- django
CWE
CWE-264
Permissions, Privileges, and Access Controls