PYSEC-2025-47

vendorUSosv

Advisory ansehen veröffentlicht 2025-06-05Lizenz: CC-BY-4.0

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-48432US	medium5.3	0.75% (55th)	—	2025-06-05
An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attac…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

http://www.openwall.com/lists/oss-security/2025/06/04/5WEB
https://docs.djangoproject.com/en/dev/releases/security/WEB
https://github.com/advisories/GHSA-7xr5-9hcq-chf9ADVISORY
https://groups.google.com/g/django-announceWEB
https://www.djangoproject.com/weblog/2025/jun/04/security-releases/ARTICLE

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan