Information Exposure Affecting djangorestframework package, versions [,2.3.12)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-DJANGORESTFRAMEWORK-40759
- published 4 Dec 2017
- disclosed 15 Jan 2014
- credit Unknown
How to fix?
Upgrade djangorestframework to version 2.3.12 or higher.
Overview
Affected versions of djangorestframework are vulnerable to Information Exposure.
OrderingField allows ordering on any fields, which an malicious attacker can exploit and ordering fields that are not visible and get sensitive data.
References
CVSS Scores
version 3.1