Vulnetix
Try Vulnetix Request Demo
CVE-2022-36359 PUBLISHED

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

EPSS 0.79% · 73.7th percentile

Risk Scores

EPSS Score
0.79%
73.7th percentile

Affected Products

VendorProductVersions
Bitnamidjango4.0.0, 4.0.0, 3.2.0
Bitnamidjango4.0.0, 3.2.0

Timeline

References

Open in Interactive Console →