← Back

CVE-2013-0305

nvd nist
Published: May 2, 2013Modified: Apr 29, 2026

JSON object

Loading...
4.0
Vector
AV:N/AC:L/Au:S/C:P/I:N/A:N
Exploitability: 8.0 / Impact: 2.9
Source: NVD

Description

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.

Affected (17)

Djangoproject
1 product
Django
Canonical
1 product
Ubuntu Linux
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Djangoproject
Django
Version 1.3.1
Django
Version 1.3.2
Django
Version 1.3.3
Django
Version 1.3
Django
Version 1.3 alpha1
Django
Version 1.3 beta1
Configuration B
5 vulnerable
Vulnerable SoftwareAffected Versions
Djangoproject
Django
Version 1.4.1
Django
Version 1.4.2
Django
Version 1.4
Django
Version 1.4 alpha
Django
Version 1.4 beta
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Djangoproject
Django
Version 1.5 alpha
Django
Version 1.5 beta
Configuration D
4 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 10.04
Ubuntu Linux
Version 11.10
Ubuntu Linux
Version 12.04
Ubuntu Linux
Version 12.10

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.