Django vulnerable to Reflected File Download attack
High severity
GitHub Reviewed
Published
Aug 11, 2022
to the GitHub Advisory Database
•
Updated Apr 28, 2023
Package
Affected versions
>= 3.2, < 3.2.15
>= 4.0, < 4.0.7
Patched versions
3.2.15
4.0.7
Description
Published by the National Vulnerability Database
Aug 3, 2022
Published to the GitHub Advisory Database
Aug 11, 2022
Reviewed
Aug 11, 2022
Last updated
Apr 28, 2023
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
References