Vulnerability advisory

GHSA-6wcr-wcqm-3mfh

Django settings leak in date template filter

Published May 17, 2022Updated Sep 18, 2024OSV record ↗

Also known as CVE-2015-8213PYSEC-2015-11

Severity

CVSS 3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`1.7` to before 1.7.11	`1.7.11`Advisories →
Also listed as affected (11) `1.7` `1.7.1` `1.7.10` `1.7.2` `1.7.3` `1.7.4` `1.7.5` `1.7.6` `1.7.7` `1.7.8` `1.7.9`
`1.8a1` to before 1.8.7	`1.8.7`Advisories →
Also listed as affected (11) `1.8` `1.8.1` `1.8.2` `1.8.3` `1.8.4` `1.8.5` `1.8.6` `1.8a1` `1.8b1` `1.8b2` `1.8c1`
`1.9a1` to before 1.9rc2	`1.9rc2`Advisories →
Also listed as affected (3) `1.9a1` `1.9b1` `1.9rc1`

Description

The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.

GHSA-6wcr-wcqm-3mfh

Affected versions

django PyPI

Description

References