CVE-2022-36359: High severity django vulnerability
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-36359?
CVE-2022-36359 is a vulnerability in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7 that allows for a reflected file download attack.
How does CVE-2022-36359 affect Django?
CVE-2022-36359 affects Django versions 3.2 before 3.2.15 and 4.0 before 4.0.7.
What is the severity of CVE-2022-36359?
The severity of CVE-2022-36359 is high, with a CVSS score of 8.8.
How can I fix CVE-2022-36359 in Django?
To fix CVE-2022-36359 in Django, you should upgrade to Django version 3.2.15 or 4.0.7.
Where can I find more information about CVE-2022-36359?
You can find more information about CVE-2022-36359 at the following references: [Openwall](http://www.openwall.com/lists/oss-security/2022/08/03/1), [Django Releases](https://docs.djangoproject.com/en/4.0/releases/security/), and [Django Google Group](https://groups.google.com/g/django-announce/c/8cz--gvaJr4).