DEBIAN-CVE-2025-48432

Advisory lineage Upstream: 1 Downstream: 2
Upstream
CVE-2025-48432
Published: 05 Jun 2025, 03:15
Last modified:28 Apr 2026, 20:30

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Jun 2025, 03:15
Published
Vulnerability first disclosed
28 Apr 2026, 20:30
Last Modified
Vulnerability information updated

Description

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Systems

  • debian•python-django

    all | < 2:2.2.28-1~deb11u7 | < 3:3.2.25-0+deb12u1 | < 3:4.2.23-1 | < 3:4.2.23-1

References (1)