Summary
Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipulieren.
Product
Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.
Vulnerabilities 2
-
High 7.1
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin…
-
Medium 4.8
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-8jj7-4v57-frf5 vom 2026-08-24
https://github.com/advisories/GHSA-8jj7-4v57-frf5
-
GitHub Security Advisory GHSA-fwjf-m4qw-9f2x vom 2026-08-24
https://github.com/advisories/GHSA-fwjf-m4qw-9f2x