CVE-2015-8213: Infoleak
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY.
Other sources
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8213?
CVE-2015-8213 is categorized as a medium severity vulnerability due to the potential exposure of sensitive application secrets.
How do I fix CVE-2015-8213?
To fix CVE-2015-8213, upgrade to Django versions 1.7.11, 1.8.7, or 1.9rc2 respectively.
What versions of Django are affected by CVE-2015-8213?
CVE-2015-8213 affects Django versions up to and including 1.7.10, all versions 1.8.0 to 1.8.6, and 1.9.0-rc1.
What type of attack can exploit CVE-2015-8213?
CVE-2015-8213 can be exploited by remote attackers who can potentially retrieve sensitive application settings.
Where can I find more information about CVE-2015-8213?
More information regarding CVE-2015-8213 can be found in security advisories and update notifications from Django.