PYSEC-2014-7

    Dashboard / Vulnerabilities / PYSEC-2014-7

    PYSEC-2014-7

    Published: 26 Aug 2014Last Modified: 10 Jun 2026

    Summary:

    Details: The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.

    References: https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6, https://www.djangoproject.com/weblog/2014/aug/20/security/, http://www.debian.org/security/2014/dsa-3010, http://secunia.com/advisories/59782, http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html, http://secunia.com/advisories/61281, http://secunia.com/advisories/61276, https://github.com/advisories/GHSA-rw75-m7gp-92m3

    Affected packages

    Package

    Name: django

    Purl: pkg:pypi/django

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2b31342cdf14fc20e07c43d258f1e7334ad664a6

    Affected versions

    1.0.1
    1.0.2
    1.0.3
    1.0.4
    1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2014-7 | CVE-DB