What’s Vulnerable › Vulnerabilities

CVE-2014-0483

• Severity: low (CVSS 3.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-08-26 · updated 2026-06-17
• Weakness: CWE-264

Description

The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.

Affected products

• Django: through 1.4.13; 1.5, 1.5-alpha, 1.5-beta, 1.5.1, 1.5.2, 1.5.3 (+33)
• Opensuse: 12.3, 13.1

References

• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
• http://secunia.com/advisories/59782
• http://secunia.com/advisories/61276
• http://secunia.com/advisories/61281
• http://www.debian.org/security/2014/dsa-3010
• https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6
• https://www.djangoproject.com/weblog/2014/aug/20/security/
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
• http://secunia.com/advisories/59782
• http://secunia.com/advisories/61276
• http://secunia.com/advisories/61281
• http://www.debian.org/security/2014/dsa-3010

Get alerted when CVE-2014-0483 or the next vulnerability affects your stack