CVE-2026-48588

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Use of Cache Containing Sensitive Information pada djangoproject django. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.

Rincian

Terbit di NVD

7 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-524: Use of Cache Containing Sensitive Information

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.djangoproject.com/en/dev/releases/security/ patch · advisory vendor
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases/ advisory vendor · patch
• https://groups.google.com/g/django-announce release notes