CVE

Id
47118  
CVE No.
CVE-2010-4534  
Status
Candidate  
Description
The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.  
Phase
Assigned (20101209)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
515290 47118 CVE-2010-4534 BUGTRAQ:20101223 Django admin list filter data extraction / leakage  View
515291 47118 CVE-2010-4534 URL:http://www.securityfocus.com/archive/1/515446  View
515292 47118 CVE-2010-4534 FULLDISC:20101223 Django admin list filter data extraction / leakage  View
515293 47118 CVE-2010-4534 URL:http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0580.html  View
515294 47118 CVE-2010-4534 MLIST:[oss-security] 20101223 CVE Request -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- addressing two security flaws  View
515295 47118 CVE-2010-4534 URL:http://www.openwall.com/lists/oss-security/2010/12/23/4  View
515296 47118 CVE-2010-4534 MLIST:[oss-security] 20110103 Re: CVE Request -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- addressing two security flaws  View
515297 47118 CVE-2010-4534 URL:http://www.openwall.com/lists/oss-security/2011/01/03/5  View
515298 47118 CVE-2010-4534 MISC:http://evilpacket.net/2010/dec/22/information-leakage-django-administrative-interfac/  View
515299 47118 CVE-2010-4534 MISC:http://ngenuity-is.com/advisories/2010/dec/22/information-leakage-in-django-administrative-inter/  View
515300 47118 CVE-2010-4534 CONFIRM:http://code.djangoproject.com/changeset/15031  View
515301 47118 CVE-2010-4534 CONFIRM:http://www.djangoproject.com/weblog/2010/dec/22/security/  View
515302 47118 CVE-2010-4534 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=665373  View
515303 47118 CVE-2010-4534 FEDORA:FEDORA-2011-0096  View
515304 47118 CVE-2010-4534 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053041.html  View
515305 47118 CVE-2010-4534 FEDORA:FEDORA-2011-0120  View
515306 47118 CVE-2010-4534 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053072.html  View
515307 47118 CVE-2010-4534 UBUNTU:USN-1040-1  View
515308 47118 CVE-2010-4534 URL:http://www.ubuntu.com/usn/USN-1040-1  View
515309 47118 CVE-2010-4534 BID:45562  View
515310 47118 CVE-2010-4534 URL:http://www.securityfocus.com/bid/45562  View
515311 47118 CVE-2010-4534 SECUNIA:42715  View
515312 47118 CVE-2010-4534 URL:http://secunia.com/advisories/42715  View
515313 47118 CVE-2010-4534 SECUNIA:42827  View
515314 47118 CVE-2010-4534 URL:http://secunia.com/advisories/42827  View
515315 47118 CVE-2010-4534 SECUNIA:42913  View
515316 47118 CVE-2010-4534 URL:http://secunia.com/advisories/42913  View
515317 47118 CVE-2010-4534 VUPEN:ADV-2011-0048  View
515318 47118 CVE-2010-4534 URL:http://www.vupen.com/english/advisories/2011/0048  View
515319 47118 CVE-2010-4534 VUPEN:ADV-2011-0098  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
30775 JVNDB-2011-001014 Wireshark の sect_enttec_dmx_da 関数におけるバッファオーバーフローの脆弱性 Wireshark の epan/dissectors/packet-enttec.c 内にある sect_enttec_dmx_da 関数には、バッファオーバーフローの脆弱性が存在します。 CVE-2010-4538 47118 9.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001014.html  View