CVE-2025-48432
2 advisories.
PyPI/django CVE-2025-48432: medium 4
Django Improper Output Neutralization for Logs vulnerability
Action: Upgrade django to 4.2.22 or later.
pip install django==5.2.2pip install django==5.1.10pip install django==4.2.22Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.2 | 5.2.2 | - |
| 5.0a1 | 5.1.10 | - |
| 0 | 4.2.22 | - |
Fixed versions
| 5.2.2 | 5.1.10 | 4.2.22 |
Sources
- osv: GHSA-7xr5-9hcq-chf9
- https://nvd.nist.gov/vuln/detail/CVE-2025-48432
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-47.yaml
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/jun/04/security-releases
- https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases
- http://www.openwall.com/lists/oss-security/2025/06/04/5
- http://www.openwall.com/lists/oss-security/2025/06/10/2
- http://www.openwall.com/lists/oss-security/2025/06/10/3
- http://www.openwall.com/lists/oss-security/2025/06/10/4
CVE-2025-48432 · published · modified · JSON
PyPI/django CVE-2025-48432: unknown
An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially
Action: Upgrade django to 4.2.22 or later.
pip install django==5.2.2pip install django==5.1.10pip install django==4.2.22Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.2 | 4.2.22 | - |
| 5.1 | 5.1.10 | - |
| 5.2 | 5.2.2 | - |
Fixed versions
| 5.2.2 | 5.1.10 | 4.2.22 |
Sources
- osv: PYSEC-2025-47
- https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- http://www.openwall.com/lists/oss-security/2025/06/04/5
- https://github.com/advisories/GHSA-7xr5-9hcq-chf9
CVE-2025-48432 · published · modified · JSON