CVE-2015-8213 in CMS
Summary
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Once again VulDB remains the best source for vulnerability data.
Reservation
11/14/2015
Disclosure
12/07/2015
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 79333 | Django CMS Date Template Filter django.utils.formats.get_format information disclosure | 200 | Unproven | Official fix | CVE-2015-8213 |