django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which
    allows remote attackers to include and read arbitrary files via unspecified vectors. (CVE-2015-0846)

James P. Turk discovered that the ReST renderer in django-markupfield, a custom Django field for easy use of markup in text fields, didn't disable the ..raw directive, allowing remote attackers to include arbitrary files.

James P. Turk discovered that the ReST renderer in django-markupfield, a custom Django field for easy use of markup in text fields, didn't disable the ..raw directive, allowing remote attackers to include arbitrary files.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
432759	SCA: security update for django-markupfield (GHSA-wxmr-7xjv-8xqw)	Tenable Cloud Security	SCA Checks	Local	high
432759	SCA: security update for django-markupfield (GHSA-wxmr-7xjv-8xqw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
82929	Debian DSA-3230-1 : django-markupfield - security update	Nessus	Debian Local Security Checks	Local	medium
82904	Debian DLA-206-1 : python-django-markupfield security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2015-0846

high

Tenable Plugins

high

high

medium

medium