CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected f...
Original description
The description as published by the source.
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
django
[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"3.2.15"},{"introduced":"4.0.0"},{"fixed":"4.0.7"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-36359 python-django Fixed in: 2:2.2.28-1~deb11u1
References
- advisory openwall.com
- advisory docs.djangoproject.com
- advisory groups.google.com
- advisory security.netapp.com
- advisory debian.org
- advisory djangoproject.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov