Vulnerability advisory

GHSA-8c5j-9r9f-c6w8

Information disclosure in Django

Published Jan 12, 2022Updated Feb 21, 2025OSV record ↗

Also known as BIT-django-2021-45116CVE-2021-45116PYSEC-2022-2

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`2.2` to before 2.2.26	`2.2.26`Advisories →
Also listed as affected (26) `2.2` `2.2.1` `2.2.10` `2.2.11` `2.2.12` `2.2.13` `2.2.14` `2.2.15` `2.2.16` `2.2.17` `2.2.18` `2.2.19` `2.2.2` `2.2.20` `2.2.21` `2.2.22` `2.2.23` `2.2.24` `2.2.25` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `2.2.9`
`3.2` to before 3.2.11	`3.2.11`Advisories →
Also listed as affected (11) `3.2` `3.2.1` `3.2.10` `3.2.2` `3.2.3` `3.2.4` `3.2.5` `3.2.6` `3.2.7` `3.2.8` `3.2.9`
`4.0` to before 4.0.1	`4.0.1`Advisories →
Also listed as affected (1) `4.0`

Description

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.

GHSA-8c5j-9r9f-c6w8

Affected versions

django PyPI

Description

References