CVE-2013-0305
Django Data leakage via admin history log
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
Exploit likelihood
What each source reports
NVD Score used
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
- Record
CVE-2013-0305- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
- Record
CVE-2013-0305- Updated
- 2026-11-02
EUVDEUVD-2013-0004No score
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
- Record
EUVD-2013-0004- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r7w6-p47g-vj53
Django Data leakage via admin history log
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
- Record
GHSA-r7w6-p47g-vj53- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-r7w6-p47g-vj53
Django Data leakage via admin history log
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
- Record
GHSA-r7w6-p47g-vj53- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
- Record
CVE-2013-0305- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-0305No score
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
- Record
DEBIAN-CVE-2013-0305- Updated
- 2026-11-02
OSVPYSEC-2013-16No score
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
- Record
PYSEC-2013-16- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI | 1.3 up to 1.3.6 | 1.3.6 |
djangoPyPI | 1.4 up to 1.4.4 | 1.4.4 |
python-djangoDebian:12 | before 1.4.4-1 | 1.4.4-1 |
python-djangoDebian:13 | before 1.4.4-1 | 1.4.4-1 |
python-djangoDebian:14 | before 1.4.4-1 | 1.4.4-1 |
python-djangoDebian:6.0 From an advisory covering 4 CVEs | before 1.2.3-3+squeeze5, plus listed versions 1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze21.2.3-3+squeeze3 | 1.2.3-3+squeeze5 |
djangoPyPI | 1.3 up to 1.3.6, plus listed versions 1.3.11.3.21.3.31.3.41.3.5 | 1.3.6 |
djangoPyPI | 1.4 up to 1.4.4, plus listed versions 1.4.11.4.21.4.3 | 1.4.4 |
djangoPyPI | 1.3 up to 1.3.6, 1.4 up to 1.4.4, plus listed versions 1.3.11.3.21.3.31.3.41.3.51.4.11.4.21.4.3 | 1.3.61.4.4 |
Django14Red Hat:openstack:2::el6 From an advisory covering 4 CVEs | before 0:1.4.4-1.el6ost | 0:1.4.4-1.el6ost |
Django14-docRed Hat:openstack:2::el6 From an advisory covering 4 CVEs | before 0:1.4.4-1.el6ost | 0:1.4.4-1.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-0305 is a medium vulnerability (CVSS 4.0) in Djangoproject Django, published February 27, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in django 1.3.6.
References
djangoproject.com/weblog/2013/feb/19/security
ubuntu.com/usn/usn-1757-1
debian.org/security/2013/dsa-2634
rhn.redhat.com/errata/RHSA-2013-0670.html
nvd.nist.gov/vuln/detail/CVE-2013-0305
github.com/django/django/commit/0e7861aec73702f7933ce2a93056f7983939f0d6
Show 25 moreShow less
security-tracker.debian.org/tracker/CVE-2013-0305
access.redhat.com/errata/RHSA-2013:0670
bugzilla.redhat.com/show_bug.cgi?id=912982
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0670.json
cve.org/CVERecord?id=CVE-2013-0305