CVE-2025-48432CWE-117

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23

Medium · published June 5, 2025

CVSS v3.1
4.0
EPSS
1%
Percentile
54.5
In the wild
Unconfirmed
What it is

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00751 · 54.5th percentile
Weakness
CWE-117 · Improper Output Neutralization for Logs
Published
2025-06-05T00:00Z
EPSS history
Timeline
  • 05 JUN 00:00Z
    An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23
    cvelistv5