CVE-2015-8213
- State
- Published
- Severity
- Not scored
- Published
- Dec 7, 2015
- Updated
- Aug 6, 2024
- Reserved
- Nov 14, 2015
Description
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4
- openSUSE-SU-2015:2199vendor-advisory
- USN-2816-1vendor-advisory
- RHSA-2016:0129vendor-advisory
- https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
- FEDORA-2015-323274d412vendor-advisory
- 1034237vdb-entry
- RHSA-2016:0158vendor-advisory
- RHSA-2016:0157vendor-advisory
- DSA-3404vendor-advisory
- RHSA-2016:0156vendor-advisory
- 77750vdb-entry
- FEDORA-2015-a8c8f60fbdvendor-advisory
- openSUSE-SU-2015:2202vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.