Description

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.

Remediation

References

CVE-2013-0305

Related Vulnerabilities

WordPress Plugin Gallery-Video Gallery and Youtube Gallery Cross-Site Scripting (1.7.01)

MySQL Improper Authentication Vulnerability (CVE-2012-2122)

PHP Improper Input Validation Vulnerability (CVE-2016-10397)

WordPress Plugin Xllentech English Islamic Calendar SQL Injection (2.6.7)

WordPress 4.2.x Multiple Vulnerabilities (4.2 - 4.2.23)

Severity

Medium

Classification

CVE-2013-0305 CWE-200

Tags

Missing Update Known Vulnerabilities