CVE-2013-0306: Medium severity django vulnerability
The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified maxnum parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0306?
CVE-2013-0306 is classified as a moderate severity vulnerability that can lead to denial of service conditions.
How do I fix CVE-2013-0306?
To fix CVE-2013-0306, update Django to version 1.3.6, 1.4.4, or later.
What versions of Django are affected by CVE-2013-0306?
CVE-2013-0306 affects Django versions 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2.
Can CVE-2013-0306 lead to data loss?
While CVE-2013-0306 primarily causes denial of service, it can indirectly affect application performance and availability.
What kind of attacks can exploit CVE-2013-0306?
CVE-2013-0306 can be exploited by remote attackers who manipulate the max_num parameter in formsets.