NVD

Id
15786  
Name
CVE-2010-4534  
Description
The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2011-01-10  
Modified Date
2011-01-20  
Seq
2010-4534  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
89474 15786 CVE-2010-4534 20101223 Django admin list filter data extraction / leakage  View
89475 15786 CVE-2010-4534 http://code.djangoproject.com/changeset/15031  View
89476 15786 CVE-2010-4534 http://evilpacket.net/2010/dec/22/information-leakage-django-administrative-interfac/  View
89477 15786 CVE-2010-4534 FEDORA-2011-0096  View
89478 15786 CVE-2010-4534 FEDORA-2011-0120  View
89479 15786 CVE-2010-4534 http://ngenuity-is.com/advisories/2010/dec/22/information-leakage-in-django-administrative-inter/  View
89480 15786 CVE-2010-4534 http://www.djangoproject.com/weblog/2010/dec/22/security/  View
89481 15786 CVE-2010-4534 [oss-security] 20101223 CVE Request -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- addressing two security flaws  View
89482 15786 CVE-2010-4534 [oss-security] 20110103 Re: CVE Request -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- addressing two security flaws  View
89483 15786 CVE-2010-4534 20101223 Django admin list filter data extraction / leakage  View
89484 15786 CVE-2010-4534 45562  View
89485 15786 CVE-2010-4534 USN-1040-1  View
89486 15786 CVE-2010-4534 ADV-2011-0048  View
89487 15786 CVE-2010-4534 ADV-2011-0098  View
89488 15786 CVE-2010-4534 https://bugzilla.redhat.com/show_bug.cgi?id=665373  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
37719 JVNDB-2010-003504 Django の管理用のインターフェースにおける重要な情報を取得される脆弱性 Django の django.contrib.admin の管理用のインターフェースは、特定のオブジェクトフィルタを実行するクエリ文字列の使用を制限しないため、重要な情報を取得される脆弱性が存在します。 CVE-2010-4534 47114 CVE-2010-4534 15786 4 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-003504.html 2010-12-22 2012-03-27 View