CVE-2010-4534: Input Validation
Description of problem:
http://www.djangoproject.com/weblog/2010/dec/22/security/
Other sources
The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a createdbypasswordregex parameter.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4534?
CVE-2010-4534 is classified as a medium severity vulnerability.
How do I fix CVE-2010-4534?
To remediate CVE-2010-4534, upgrade Django to version 1.1.3 or later, or 1.2.4 or later.
What versions of Django are affected by CVE-2010-4534?
CVE-2010-4534 affects Django versions up to 1.1.2, 1.2.3, and all earlier versions.
What kind of vulnerability is CVE-2010-4534?
CVE-2010-4534 is an information leakage vulnerability in the administrative interface of Django.
Is there a workaround for CVE-2010-4534?
The recommended solution for CVE-2010-4534 is upgrading to a patched version rather than relying on a workaround.