CVE-2010-4534

The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.

Published: Jan 10, 2011
Updated: May 9, 2024
CVE: CVE-2010-4534
GHSA: GHSA-fwr5-q9rx-294f
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

CWE-264

Affected Software
References

Software	From	Fixed in
djangoproject / django	0.95	0.95.x
djangoproject / django	1.0	1.0.x
djangoproject / django	1.0.1	1.0.1.x
djangoproject / django	1.1	1.1.x
djangoproject / django	0.91	0.91.x
djangoproject / django	1.0.2	1.0.2.x
djangoproject / django	0.95.1	0.95.1.x
djangoproject / django	0.96	0.96.x
djangoproject / django	-	1.1.2.x
djangoproject / django	1.1.0	1.1.0.x
djangoproject / django	1.2.1	1.2.1.x
djangoproject / django	1.2.3	1.2.3.x
djangoproject / django	1.2	1.2.x
djangoproject / django	1.2.2	1.2.2.x
djangoproject / django	1.3-alpha1	1.3-alpha1.x
djangoproject / django	1.3-alpha2	1.3-alpha2.x
Django	-	1.1.3
Django	1.2.0	1.2.4

Vulnerability Database

289,599

CVE-2010-4534