Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2020-15225
Good to know:
Date: April 28, 2021
django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated "NumberFilter" instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a "MaxValueValidator" with a a default "limit_value" of 1e50 to the form field used by "NumberFilter" instances. In addition, "NumberFilter" implements the new "get_max_validator()" which should return a configured validator instance to customise the limit, or else "None" to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.
Language: Python
Severity Score
Related Resources (17)
Severity Score
Weakness Type (CWE)
Incorrect Conversion between Numeric Types
CWE-681Top Fix
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | HIGH |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | LOW |
| Authentication (AU): | SINGLE |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | PARTIAL |
| Additional information: |