GHSA-qh9x-mc42-vg4g

Suggest an improvement
Source
https://github.com/advisories/GHSA-qh9x-mc42-vg4g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qh9x-mc42-vg4g/GHSA-qh9x-mc42-vg4g.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-qh9x-mc42-vg4g
Aliases
Published
2022-05-14T03:32:28Z
Modified
2024-11-26T05:31:36.459827Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
django-anymail Includes Sensitive Information in Log Files
Details

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAILWEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.

Database specific
{
    "nvd_published_at": "2018-03-13T15:29:00Z",
    "cwe_ids": [
        "CWE-532"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-27T21:33:52Z"
}
References

Affected packages

PyPI / django-anymail

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.2
Fixed
1.4

Affected versions

0.*

0.2
0.3
0.3.1
0.4.1
0.4.2
0.5
0.6
0.6.1
0.7
0.8
0.9
0.10
0.11
0.11.1

1.*

1.0rc0
1.0
1.1
1.2
1.2.1
1.3