onyx --cves cve-2022-36359
CVE-2022-36359
- score
- <0.1
- cvss
- 8.8
- epss
- 0.9%
- published
- 2022-08-03
- kev added
- —
- first seen
Django 3.2 < 3.2.15 and 4.0 < 4.0.7 contain a reflected file download caused by setting Content-Disposition header from user input in FileResponse, letting attackers perform reflected file download attacks, exploit requires user-supplied filename.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 7
- https://www.djangoproject.com/weblog/2022/aug/03/security-releases/
- http://www.openwall.com/lists/oss-security/2022/08/03/1
- https://groups.google.com/g/django-announce/c/8cz--gvaJr4
- https://security.netapp.com/advisory/ntap-20220915-0008/
- https://www.debian.org/security/2022/dsa-5254
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/