{"id":"CVE-2022-36359","published":"2022-08-03T00:00:00Z","modified":"2025-02-13T16:32:48Z","title":"An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00935,"percentile":0.60792,"provenance":"source"},"cwes":[],"references":[{"url":"https://docs.djangoproject.com/en/4.0/releases/security/","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/03/1","tags":["mailing-list"]},{"url":"https://groups.google.com/g/django-announce/c/8cz--gvaJr4","tags":[]},{"url":"https://www.djangoproject.com/weblog/2022/aug/03/security-releases/","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0008/","tags":[]},{"url":"https://www.debian.org/security/2022/dsa-5254","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/","tags":["vendor-advisory"]}],"priority":{"score":12.2,"factors":[{"name":"EPSS percentile","points":12.16}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":["<3.2.15",">=4.0, <4.0.7",">=3.2, <3.2.15"],"patched":["3.2.15","4.0.7"],"from":["GHSA-8x94-hmjh-97hq","PYSEC-2022-245"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0092","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sinatra-cve-2022-36359","children":[{"from":"CVE-2022-36359","to":"CVE-2022-45442","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-8x94-hmjh-97hq","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-2x8x-jmrp-phxw","via":"reference","url":"https://github.com/advisories/GHSA-8x94-hmjh-97hq"}]}],"packageHistory":[{"cve":"CVE-2022-28346","published":"2022-04-12","fixed":"4.0.4","kev":false},{"cve":"CVE-2022-28347","published":"2022-04-12","fixed":"4.0.4","kev":false},{"cve":"CVE-2022-34265","published":"2022-07-04","fixed":"4.0.6","kev":false,"link":{"from":"CVE-2022-34265","to":"CVE-2022-36359","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.14","toFixed":"3.2.15","daysApart":30},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.0.6","toFixed":"4.0.7","daysApart":30}]}},{"cve":"CVE-2022-36359","published":"2022-08-03","fixed":"4.0.7","kev":false},{"cve":"CVE-2022-41323","published":"2022-10-16","fixed":"4.1.2","kev":false,"link":{"from":"CVE-2022-36359","to":"CVE-2022-41323","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.2.15","toFixed":"3.2.16","daysApart":74},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"4.0.7","toFixed":"4.0.8","daysApart":74}]}},{"cve":"CVE-2023-23969","published":"2023-02-01","fixed":"4.1.6","kev":false},{"cve":"CVE-2023-24580","published":"2023-02-15","fixed":"4.1.7","kev":false}],"package":"PyPI:Django"}}