CVE-2022-36359
03.08.2022, 14:15
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.Enginsight
| Vendor | Product | Version |
|---|---|---|
| djangoproject | django | 3.2 ≤ 𝑥 < 3.2.15 |
| djangoproject | django | 4.0 ≤ 𝑥 < 4.0.7 |
| debian | debian_linux | 11.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References