Search for vulnerabilities
Vulnerability details: VCID-1ay6-j864-aaaq
Vulnerability ID VCID-1ay6-j864-aaaq
Aliases BIT-django-2022-36359
CVE-2022-36359
GHSA-8x94-hmjh-97hq
PYSEC-2022-245
Summary An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
System Score Found at
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00347 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00423 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00455 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00599 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00599 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
epss 0.00599 https://api.first.org/data/v1/epss?cve=CVE-2022-36359
cvssv3.1 7.5 https://docs.djangoproject.com/en/4.0/releases/security
generic_textual HIGH https://docs.djangoproject.com/en/4.0/releases/security
cvssv3.1 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-8x94-hmjh-97hq
cvssv3.1 3.7 https://github.com/django/django
generic_textual MODERATE https://github.com/django/django
cvssv3.1 8.8 https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
generic_textual HIGH https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
cvssv3.1 8.8 https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
generic_textual HIGH https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
cvssv3.1 8.8 https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
generic_textual HIGH https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
cvssv3.1 8.8 https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
cvssv3.1 8.8 https://groups.google.com/g/django-announce/c/8cz--gvaJr4
generic_textual HIGH https://groups.google.com/g/django-announce/c/8cz--gvaJr4
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
cvssv3 8.8 https://nvd.nist.gov/vuln/detail/CVE-2022-36359
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2022-36359
archlinux Unknown https://security.archlinux.org/AVG-2810
cvssv3.1 8.8 https://security.netapp.com/advisory/ntap-20220915-0008
generic_textual HIGH https://security.netapp.com/advisory/ntap-20220915-0008
cvssv3.1 8.8 https://www.debian.org/security/2022/dsa-5254
generic_textual HIGH https://www.debian.org/security/2022/dsa-5254
cvssv3.1 8.8 https://www.djangoproject.com/weblog/2022/aug/03/security-releases
generic_textual HIGH https://www.djangoproject.com/weblog/2022/aug/03/security-releases
cvssv3.1 8.8 http://www.openwall.com/lists/oss-security/2022/08/03/1
generic_textual HIGH http://www.openwall.com/lists/oss-security/2022/08/03/1
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-36359
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22818
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23833
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28346
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28347
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34265
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36359
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41323
https://docs.djangoproject.com/en/4.0/releases/security
https://docs.djangoproject.com/en/4.0/releases/security/
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/django/django
https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
https://groups.google.com/g/django-announce/c/8cz--gvaJr4
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://security.netapp.com/advisory/ntap-20220915-0008
https://security.netapp.com/advisory/ntap-20220915-0008/
https://www.debian.org/security/2022/dsa-5254
https://www.djangoproject.com/weblog/2022/aug/03/security-releases
https://www.djangoproject.com/weblog/2022/aug/03/security-releases/
http://www.openwall.com/lists/oss-security/2022/08/03/1
AVG-2810 https://security.archlinux.org/AVG-2810
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CVE-2022-36359 https://nvd.nist.gov/vuln/detail/CVE-2022-36359
GHSA-8x94-hmjh-97hq https://github.com/advisories/GHSA-8x94-hmjh-97hq
USN-5549-1 https://usn.ubuntu.com/5549-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://docs.djangoproject.com/en/4.0/releases/security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://groups.google.com/g/django-announce/c/8cz--gvaJr4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-36359
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-36359
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20220915-0008
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2022/dsa-5254
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.djangoproject.com/weblog/2022/aug/03/security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2022/08/03/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Exploit Prediction Scoring System (EPSS)
Percentile 0.70199
EPSS Score 0.00321
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.