Vulnerability advisory
CVE-2025-48432
Also known as BIT-django-2025-48432GHSA-7xr5-9hcq-chf9PYSEC-2025-47
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/django/django ↗ | |
| 97aa3b7f08f51669e118f3af5ca91026e39664c3 to before a698dc223be0e245c8e9cf347defc1892ae5e3ea | a698dc223be0e245c8e9cf347defc1892ae5e3ea |
| 84d09a547fe35e10018ab242602ca76c29ca91a1 to before 2285698fc1e41ff34dffcc0625528a8db7318a18 | 2285698fc1e41ff34dffcc0625528a8db7318a18 |
| 9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before 15883bc669303242742a81f06958175dddbb66de | 15883bc669303242742a81f06958175dddbb66de |
Also listed as affected (3)
| |
Description
An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
References
- Webwww.openwall.com/lists/oss-security/2025/06/04/5 ↗
- Webwww.openwall.com/lists/oss-security/2025/06/10/2 ↗
- Webwww.openwall.com/lists/oss-security/2025/06/10/3 ↗
- Webwww.openwall.com/lists/oss-security/2025/06/10/4 ↗
- Webdocs.djangoproject.com/en/dev/releases/security/ ↗
- Webgroups.google.com/g/django-announce ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48432.json ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2025-48432 ↗
- ARTICLEwww.djangoproject.com/weblog/2025/jun/04/security-releases/ ↗
- ARTICLEwww.djangoproject.com/weblog/2025/jun/10/bugfix-releases/ ↗