CVE-2013-0305
CVE-2013-0305
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
CVSS 5.3 · Medium · EPSS 1.8% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
python-django Debian:12
- Affected ranges
- ECOSYSTEM: < 1.4.4-1
Update to 1.4.4-1
python-django Debian:13
- Affected ranges
- ECOSYSTEM: < 1.4.4-1
Update to 1.4.4-1
python-django Debian:14
- Affected ranges
- ECOSYSTEM: < 1.4.4-1
Update to 1.4.4-1
django PyPI
- Versions
- 1.3
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.3.5
- Affected ranges
- ECOSYSTEM: ≥ 1.3, < 1.3.6
Update to 1.3.6
django PyPI
- Versions
- 1.4
- 1.4.1
- 1.4.2
- 1.4.3
- Affected ranges
- ECOSYSTEM: ≥ 1.4, < 1.4.4
Update to 1.4.4
django PyPI
- Versions
- 1.3
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.3.5
- 1.4
- 1.4.1
- 1.4.2
- 1.4.3
- Affected ranges
- ECOSYSTEM: ≥ 1.3, < 1.3.6 ∪ ≥ 1.4, < 1.4.4
Update to 1.3.6; Update to 1.4.4