CVE-2015-8213

{"id": "CVE-2015-8213", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-12-07T20:59:17.613", "references": [{"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html", "source": "cve@mitre.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html", "source": "cve@mitre.org"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html", "source": "cve@mitre.org"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html", "source": "cve@mitre.org"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html", "source": "cve@mitre.org"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2015/dsa-3404", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/77750", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1034237", "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/USN-2816-1", "source": "cve@mitre.org"}, {"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4", "source": "cve@mitre.org"}, {"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.debian.org/security/2015/dsa-3404", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/77750", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1034237", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ubuntu.com/usn/USN-2816-1", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY."}, {"lang": "es", "value": "La funci\u00f3n get_format en utils/formats.py en Django en versiones anteriores a 1.7.x en versiones anteriores a 1.7.11, 1.8.x en versiones anteriores a 1.8.7 y 1.9.x en versiones anteriores a 1.9rc2 puede permitir a atacantes remotos obtener secretos sensibles de aplicaciones a trav\u00e9s de una clave de ajustes en lugar de un ajuste de formato de fecha/hora, seg\u00fan lo demostrado por SECRET_KEY."}], "lastModified": "2024-11-21T02:38:05.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDD6D743-BCFB-49E9-A287-8E36E6E619D6", "versionEndIncluding": "1.7.10"}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02D3C0FF-C342-40F1-A187-CD212C16FE8F"}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2510BAD7-1FB6-4F6F-A2CC-9DE9AD39B4FF"}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1B388C7-ED4E-4416-969F-32263E7D7AA8"}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63D36984-4C8E-4CDB-8D15-445705FCECF9"}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B324AE6-ADD8-41B9-B250-A6577ACBB364"}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6487058-6768-4AD3-BE27-A0B3D1ACFC08"}, {"criteria": "cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CFF0538-B111-44A8-ADC2-87E280186257"}, {"criteria": "cpe:2.3:a:djangoproject:django:1.9.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "832F9FA9-5FC8-4DB6-AD39-C3D1C21C4568"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}