An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
References
| Link | Resource |
|---|---|
| https://docs.djangoproject.com/en/dev/releases/security/ | Vendor Advisory |
| https://groups.google.com/g/django-announce | Vendor Advisory |
| https://www.djangoproject.com/weblog/2025/jun/04/security-releases/ | Vendor Advisory |
| https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/ | Release Notes |
| http://www.openwall.com/lists/oss-security/2025/06/04/5 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/06/10/2 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/06/10/3 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/06/10/4 | Mailing List |
Configurations
History
15 Oct 2025, 17:47
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Djangoproject django
Debian debian Linux Djangoproject Debian |
|
| CPE | cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
|
| References | () https://docs.djangoproject.com/en/dev/releases/security/ - Vendor Advisory | |
| References | () https://groups.google.com/g/django-announce - Vendor Advisory | |
| References | () https://www.djangoproject.com/weblog/2025/jun/04/security-releases/ - Vendor Advisory | |
| References | () https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/ - Release Notes | |
| References | () http://www.openwall.com/lists/oss-security/2025/06/04/5 - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2025/06/10/2 - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2025/06/10/3 - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2025/06/10/4 - Mailing List |
10 Jun 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-05 03:15
Updated : 2025-10-15 17:47
NVD link : CVE-2025-48432
Mitre link : CVE-2025-48432
CVE.ORG link : CVE-2025-48432
JSON object : View
Products Affected
djangoproject
- django
debian
- debian_linux
CWE
CWE-117
Improper Output Neutralization for Logs