CVE-2014-0483
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.
- EPSS
- 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
- opensuse:opensuse
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rw75-m7gp-92m3 | PyPI | django | <1.4.14 | 1.4.14 |
| GHSA-rw75-m7gp-92m3 | PyPI | django | >=1.5 <1.5.9 | 1.5.9 |
| GHSA-rw75-m7gp-92m3 | PyPI | django | >=1.6 <1.6.6 | 1.6.6 |
| GHSA-rw75-m7gp-92m3 | PyPI | django | >=1.7a1 <1.7c3 | 1.7c3 |
| PYSEC-2014-7 | PyPI | django | <1.4.14 >=1.5 <1.5.9 >=1.6 <1.6.6 | 1.4.14, 1.5.9, 1.6.6 |