{"id":"CVE-2015-8213","aliases":["DEBIAN-CVE-2015-8213","DLA-349-1","DSA-3404-1","EUVD-2015-0006","GHSA-6wcr-wcqm-3mfh","MGASA-2015-0463","PYSEC-2015-11","RHSA-2016:0129","RHSA-2016:0156","RHSA-2016:0157","RHSA-2016:0158","RHSA-2016:0360","SUSE-SU-2015:2327-1","SUSE-SU-2016:0040-1","SUSE-SU-2016:0044-1","UBUNTU-CVE-2015-8213","USN-2816-1"],"status":"published","title":"Django settings leak in date template filter","description":"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04284,"percentile":0.91178,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-11-24T17:00:00Z","modified":"2026-09-09T06:47:29Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.7.11","1.9rc2","1.8.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.8.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.8.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.8.7-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"python-django","fixed_in":["1.2.3-3+squeeze15"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"python-django","fixed_in":["1.4.5-1+deb7u14"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"python-django","fixed_in":["1.7.7-1+deb8u3"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"python-django","fixed_in":["1.8.7-1.mga5"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-django","fixed_in":["0:1.6.11-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-django-bash-completion","fixed_in":["0:1.6.11-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-django-doc","fixed_in":["0:1.6.11-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-django","fixed_in":["0:1.8.7-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-django-bash-completion","fixed_in":["0:1.8.7-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-django-doc","fixed_in":["0:1.8.7-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django","fixed_in":["0:1.6.11-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-bash-completion","fixed_in":["0:1.6.11-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-doc","fixed_in":["0:1.6.11-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django","fixed_in":["0:1.6.11-4.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-bash-completion","fixed_in":["0:1.6.11-4.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-doc","fixed_in":["0:1.6.11-4.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-optools:7::el7","package":"python-django","fixed_in":["0:1.6.11-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-optools:7::el7","package":"python-django-bash-completion","fixed_in":["0:1.6.11-4.el7ost"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 1.0","package":"python-Django","fixed_in":["1.6.11-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"python-Django","fixed_in":["1.6.11-13.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.11"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7.11"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9a1"},{"fixed":"1.9rc2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8a1"},{"fixed":"1.8.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3+squeeze15"}]}],"versions":["1.2.3-3","1.2.3-3+squeeze1","1.2.3-3+squeeze10","1.2.3-3+squeeze11","1.2.3-3+squeeze12","1.2.3-3+squeeze13","1.2.3-3+squeeze14","1.2.3-3+squeeze2","1.2.3-3+squeeze3","1.2.3-3+squeeze5","1.2.3-3+squeeze6","1.2.3-3+squeeze7","1.2.3-3+squeeze8","1.2.3-3+squeeze9"]},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u14"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u10","1.4.5-1+deb7u11","1.4.5-1+deb7u11~bpo60+1","1.4.5-1+deb7u12","1.4.5-1+deb7u13","1.4.5-1+deb7u13~bpo60+1","1.4.5-1+deb7u14~bpo60+1","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7","1.4.5-1+deb7u7~bpo60+1","1.4.5-1+deb7u8","1.4.5-1+deb7u8~bpo60+1","1.4.5-1+deb7u9"]},{"source":"osv","ecosystem":"Debian:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-1+deb8u3"}]}],"versions":["1.7.7-1","1.7.7-1+deb8u1","1.7.7-1+deb8u2"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7.11"}]}],"versions":["1.7","1.7.1","1.7.10","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8a1"},{"fixed":"1.8.7"}]}],"versions":["1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8a1","1.8b1","1.8b2","1.8c1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9a1"},{"fixed":"1.9rc2"}]}],"versions":["1.9a1","1.9b1","1.9rc1"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1.mga5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"316bc3fc9437c5960c24baceb93c73f1939711e4"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.11"},{"introduced":"1.8"},{"fixed":"1.8.7"},{"introduced":"1.9a0"},{"fixed":"1.9rc2"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.9a1","1.9b1","1.9rc1","1.7a2","1.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-optools:7::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-optools:7::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-4.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 1.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 2","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.11"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.11"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10"]}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4","tags":["x_refsource_CONFIRM","x_transferred","fix","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2816-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0129.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","article","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1034237","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0158.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0157.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.debian.org/security/2015/dsa-3404","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0156.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/77750","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8213","tags":["advisory"]},{"url":"https://github.com/django/django/commit/3ebbda0aef9e7a90ac6208bb8f9bc21228e2c7da","tags":["web"]},{"url":"https://github.com/django/django/commit/8a01c6b53169ee079cb21ac5919fdafcc8c5e172","tags":["web"]},{"url":"https://github.com/django/django/commit/9f83fc2f66f5a0bac7c291aec55df66050bb6991","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-11.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6wcr-wcqm-3mfh","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8213","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0463.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17215","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2816-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0129","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1283553","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0129.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8213","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8213","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0156","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0156.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0157","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0157.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0158","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0158.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0360","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0360.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152327-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/955412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8213","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160040-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160044-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/937522","tags":["report"]},{"url":"https://bugzilla.suse.com/937523","tags":["report"]},{"url":"https://bugzilla.suse.com/941587","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8213","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2816-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-8213","description":"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.","status":"published","published":"2015-12-07T20:00:00Z","modified":"2024-08-06T08:13:31.831Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-0006","description":"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.","status":"published","published":"2015-12-07T20:00:00Z","modified":"2024-08-06T08:13:31Z","updated_at":"2026-11-03T01:57:28.296316Z"}],"ghsa":[{"id":"GHSA-6wcr-wcqm-3mfh","title":"Django settings leak in date template filter","description":"The get_format function in `utils/formats.py` in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by `SECRET_KEY`.","status":"published","published":"2022-05-17T03:25:24Z","modified":"2024-09-18T14:37:18Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2015-8213","description":"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.","status":"published","published":"2015-12-07T20:59:17.613Z","modified":"2026-06-17T00:34:07.43Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:14.501367Z"}],"osv":[{"id":"GHSA-6wcr-wcqm-3mfh","title":"Django settings leak in date template filter","description":"The get_format function in `utils/formats.py` in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by `SECRET_KEY`.","status":"published","published":"2022-05-17T03:25:24Z","modified":"2024-09-18T14:57:46.446861Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"CVE-2015-8213","description":"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.","status":"published","published":"2015-12-07T20:59:17Z","modified":"2026-04-16T06:15:13.594153566Z","updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8213","description":"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.","status":"published","published":"2015-12-07T20:59:17.613Z","modified":"2026-09-09T06:47:29.746909134Z","updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"DLA-349-1","title":"python-django - security update","status":"published","published":"2015-11-25T00:00:00Z","modified":"2026-03-09T01:22:23.251923Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3404-1","title":"python-django - security update","status":"published","published":"2015-11-25T00:00:00Z","modified":"2026-03-09T01:20:02.844586Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0463","title":"Updated python-django packages fix security vulnerability","description":"If an application allows users to specify an unvalidated format for dates\nand passes this format to the date filter, then a malicious user could\nobtain any secret in the application's settings by specifying a settings\nkey instead of a date format (CVE-2015-8213).\n","status":"published","published":"2015-12-04T23:31:36Z","modified":"2026-04-16T06:24:01.76739589Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"PYSEC-2015-11","description":"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.","status":"published","published":"2015-12-07T20:59:00Z","modified":"2026-06-10T17:00:57.035450367Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2016:0129","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T09:47:45Z","modified":"2026-06-29T10:11:22Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2016:0156","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T09:47:49Z","modified":"2026-06-29T10:11:23Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2016:0157","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T09:47:40Z","modified":"2026-06-29T10:11:24Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2016:0158","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T09:47:48Z","modified":"2026-06-29T10:11:25Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2016:0360","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-13T09:47:25Z","modified":"2026-06-29T10:11:44Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2015:2327-1","title":"Security update for python-Django","description":"\nThis update for python-Django fixes the following issues: \n\n- Add 0004-1.6.x-fixed-a-settings-leak-possibility-in-the-date-.patch\n  to prevent settings leak in date template filter (bsc#955412, CVE-2015-8213)\n","status":"published","published":"2015-12-19T11:25:20Z","modified":"2026-02-04T03:06:33.343292Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0040-1","title":"Security update for python-Django","description":"\nThis update for python-Django fixes the following issues: \n\n- Prevent settings leak in date template filter. (bsc#955412, CVE-2015-8213)\n","status":"published","published":"2016-01-07T09:00:29Z","modified":"2026-02-04T03:50:00.943372Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0044-1","title":"Security update for python-Django","description":"\n\nThis update fixes the following security issues:\n\n\n- (bnc#955412, CVE-2015-8213) Possible settings leak in date template filter \n\n- (bnc#937522, CVE-2015-5143) Possible denial-of-service in session store\n\n- (bnc#937523, CVE-2015-5144) Possible Header injection\n\n- (bnc#941587, CVE-2015-5963) Possible denial-of-service by filling session store via logout()\n\n","status":"published","published":"2016-01-07T11:04:29Z","modified":"2026-02-04T03:47:07.985736Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-8213","description":"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.","status":"published","published":"2015-11-24T17:00:00Z","modified":"2026-02-04T03:49:39.149844Z","updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"USN-2816-1","title":"python-django vulnerability","description":"Ryan Butterfield discovered that Django incorrectly handled the date\ntemplate filter. A remote attacker could possibly use this issue to obtain\nsecrets from application settings.\n","status":"published","published":"2015-11-24T17:55:14Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}