CVE-2014-0483: Infoleak
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.
Other sources
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0483?
CVE-2014-0483 has a high severity level as it allows remote authenticated users to access sensitive information through the administrative interface.
How do I fix CVE-2014-0483?
To fix CVE-2014-0483, upgrade to Django versions 1.7c3 or higher, 1.6.6, 1.5.9, or 1.4.14.
Which versions of Django are affected by CVE-2014-0483?
CVE-2014-0483 affects Django versions before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 earlier than release candidate 3.
What type of vulnerability is CVE-2014-0483?
CVE-2014-0483 is a vulnerability in the administrative interface of Django that fails to check model relationships.
Can authenticated users exploit CVE-2014-0483?
Yes, remote authenticated users can exploit CVE-2014-0483 to obtain sensitive information.