Strix
26.1K

CVE-2010-4534

UnknownEPSS 1.70%

Last modified

CVE-2010-4534 is a vulnerability of currently unknown severity. The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.. EPSS estimates a 1.70% chance of exploitation in the next 30 days.

Description

The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.

Metrics

EPSS Probability
1.70%

74.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
DjangoprojectDjango<= 1.1.2—
DjangoprojectDjango0.91—
DjangoprojectDjango0.95—
DjangoprojectDjango0.95.1—
DjangoprojectDjango0.96—
DjangoprojectDjango1.0—
DjangoprojectDjango1.0.1—
DjangoprojectDjango1.0.2—
DjangoprojectDjango1.1—
DjangoprojectDjango1.1.0—
DjangoprojectDjango1.2—
DjangoprojectDjango1.2.1—
DjangoprojectDjango1.2.2—
DjangoprojectDjango1.2.3—
DjangoprojectDjango1.3Alpha1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2010-4534?
The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.
How severe is CVE-2010-4534?
Severity scoring for CVE-2010-4534 is pending analysis. The EPSS model estimates a 1.70% probability of exploitation in the next 30 days.
How do I fix CVE-2010-4534?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2010-4534?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST