Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-45116

Good to know:

icon
icon

Date: January 4, 2022

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.

Language: Python

Severity Score

Related Resources (18)

https://docs.djangoproject.com/en/4.0/releases/security
https://nvd.nist.gov/vuln/detail/CVE-2021-45116
https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
https://github.com/django/django/commit/c9f648ccfac5ab90fb2829a66da4f77e68c7f93a
https://github.com/advisories/GHSA-8c5j-9r9f-c6w8
https://github.com/django/django
https://github.com/django/django/commit/2a8ec7f546d6d5806e221ec948c5146b55bd7489
https://security.netapp.com/advisory/ntap-20220121-0005/
https://docs.djangoproject.com/en/4.0/releases/security/
https://www.djangoproject.com/weblog/2022/jan/04/security-releases
https://security.netapp.com/advisory/ntap-20220121-0005
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
https://groups.google.com/forum/#!forum/django-announce
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
https://github.com/django/django/commit/c7fe895bca06daf12cc1670b56eaf72a1ef27a16
https://groups.google.com/forum/#%21forum/django-announce
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-2.yaml
https://www.mend.io/vulnerability-database/CVE-2021-45116

Severity Score

Weakness Type (CWE)

Exposure of Resource to Wrong Sphere

CWE-668

Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version Django - 2.2.26,3.2.11,4.0.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us