CVE-2010-4534: django - Improper Restriction of Query String to Perform Object Filtering
Summary
CVE-2010-4534: Improper query string handling in Django. Affects django across 2 version ranges.
< 1.1.3
>= 1.2, < 1.2.4
Fixed in 1.1.3 or 1.2.4, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2010-4534 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a comprehensive set of tools and features for building secure and scalable websites. However, prior to versions 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1, Django's administrative interface (django.contrib.admin) had a vulnerability that allowed remote authenticated users to obtain sensitive information.
Vulnerability Detail
The vulnerability in Django's administrative interface arises from improper restriction of the use of the query string to perform object filtering. This flaw enables remote authenticated users to retrieve sensitive information by sending a series of requests containing regular expressions. An attacker could exploit this vulnerability by manipulating the 'created_by__password__regex' parameter in the query string. By doing so, they could obtain sensitive information, such as user passwords, through a series of crafted requests.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.1.31.1.3pip install --upgrade "django==1.1.3" -
>= 1.2, < 1.2.41.2.4pip install --upgrade "django==1.2.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section and upgrade to the latest secure version of Django.
Conclusion
In conclusion, the vulnerability in Django's administrative interface allows remote authenticated users to obtain sensitive information by manipulating the query string. To mitigate this vulnerability, it is crucial to upgrade Django to the latest secure version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability allows remote authenticated users to obtain sensitive information, potentially compromising the security and privacy of the affected Django application.
Django versions prior to 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 are affected by this vulnerability. If you are using any of these versions, it is recommended to upgrade to the latest secure version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits available for this vulnerability at the time of writing. However, it is important to patch your Django installation to prevent any potential exploitation.
You can find more information about this vulnerability, including its technical details and the fixed versions of Django, in the advisory published by GitHub at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-fwr5-q9rx-294f/GHSA-fwr5-q9rx-294f.json
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
