Information disclosure in Django
High severity
GitHub Reviewed
Published
Jan 12, 2022
to the GitHub Advisory Database
•
Updated Sep 3, 2023
Package
Affected versions
>= 2.2.0, < 2.2.26
>= 3.2.0, < 3.2.11
>= 4.0.0, < 4.0.1
Patched versions
2.2.26
3.2.11
4.0.1
Description
Published by the National Vulnerability Database
Jan 5, 2022
Reviewed
Jan 12, 2022
Published to the GitHub Advisory Database
Jan 12, 2022
Last updated
Sep 3, 2023
Credits
-
tdunlap607 Analyst
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
References