CVE-2013-0305

Django Data leakage via admin history log

4.0 MediumFix available

CVE-2013-0305 is a medium vulnerability (CVSS 4.0) in Djangoproject Django, published February 27, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in django 1.3.6.

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.

Exploit likelihood

1.82%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2013-0305
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-0305
Updated: 2026-11-02

EUVDEUVD-2013-0004 No score

Record: EUVD-2013-0004
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r7w6-p47g-vj53 5.3

Django Data leakage via admin history log

Record: GHSA-r7w6-p47g-vj53
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-r7w6-p47g-vj53 5.3

Django Data leakage via admin history log

Record: GHSA-r7w6-p47g-vj53
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV No score

Record: CVE-2013-0305
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-0305 No score

Record: DEBIAN-CVE-2013-0305
Updated: 2026-11-02

OSVPYSEC-2013-16 No score

Record: PYSEC-2013-16
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`django` PyPI	1.3 up to 1.3.6	1.3.6
`django` PyPI	1.4 up to 1.4.4	1.4.4
`python-django` Debian:12	before 1.4.4-1	1.4.4-1
`python-django` Debian:13	before 1.4.4-1	1.4.4-1
`python-django` Debian:14	before 1.4.4-1	1.4.4-1
`python-django` Debian:6.0	before 1.2.3-3+squeeze5, plus listed versions 1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze21.2.3-3+squeeze3	1.2.3-3+squeeze5
`django` PyPI	1.3 up to 1.3.6, plus listed versions 1.3.11.3.21.3.31.3.41.3.5	1.3.6
`django` PyPI	1.4 up to 1.4.4, plus listed versions 1.4.11.4.21.4.3	1.4.4
`django` PyPI	1.3 up to 1.3.6, 1.4 up to 1.4.4, plus listed versions 1.3.11.3.21.3.31.3.41.3.51.4.11.4.21.4.3	1.3.61.4.4
`Django14` Red Hat:openstack:2::el6	before 0:1.4.4-1.el6ost	0:1.4.4-1.el6ost
`Django14-doc` Red Hat:openstack:2::el6	before 0:1.4.4-1.el6ost	0:1.4.4-1.el6ost

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 25 moreShow less