CVE-2022-36359: High severity djangoproject Django vulnerability
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.2.15 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.2.16-r0 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.2.15-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.15-1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1
Event History
Frequently Asked Questions
What is CVE-2022-36359?
CVE-2022-36359 is a vulnerability in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7 that allows for a reflected file download attack.
How does CVE-2022-36359 affect Django?
CVE-2022-36359 affects Django versions 3.2 before 3.2.15 and 4.0 before 4.0.7.
What is the severity of CVE-2022-36359?
The severity of CVE-2022-36359 is high, with a CVSS score of 8.8.
How can I fix CVE-2022-36359 in Django?
To fix CVE-2022-36359 in Django, you should upgrade to Django version 3.2.15 or 4.0.7.
Where can I find more information about CVE-2022-36359?
You can find more information about CVE-2022-36359 at the following references: [Openwall](http://www.openwall.com/lists/oss-security/2022/08/03/1), [Django Releases](https://docs.djangoproject.com/en/4.0/releases/security/), and [Django Google Group](https://groups.google.com/g/django-announce/c/8cz--gvaJr4).