CVE-2015-8213: Django - Sensitive Application Secrets Disclosure
Summary
CVE-2015-8213: The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in pla... Affects django across 4 version ranges.
< 1.7.11
>= 1.8, < 1.8.7
>= 1.9a0, < 1.9rc2
< 316bc3fc9437c5960c24baceb93c73f1939711e4
Fixed in 1.7.11, 1.8.7 or 1.9rc2, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2015-8213 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a robust set of tools and features for building secure and scalable websites. However, a vulnerability has been discovered in Django versions before 1.7.11, 1.8.7, and 1.9rc2. This vulnerability allows remote attackers to obtain sensitive application secrets by exploiting a flaw in the get_format function in utils/formats.py. By providing a settings key instead of a valid date/time format setting, an attacker can retrieve the SECRET_KEY, which can lead to unauthorized access and potential data breaches.
Vulnerability Detail
The vulnerability arises from a lack of input validation in the get_format function of Django. When a settings key is provided instead of a valid date/time format setting, the function mistakenly returns the value associated with the settings key, which can include sensitive information such as the SECRET_KEY. This vulnerability can be exploited remotely by an attacker, potentially leading to unauthorized access to the application and its data. It is important to note that this vulnerability only affects Django versions before 1.7.11, 1.8.7, and 1.9rc2.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.111.7.11pip install --upgrade "django==1.7.11" -
>= 1.8, < 1.8.71.8.7pip install --upgrade "django==1.8.7" -
>= 1.9a0, < 1.9rc21.9rc2pip install --upgrade "django==1.9rc2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately possible, a temporary workaround can be implemented by ensuring that only valid date/time format settings are used in the application's configuration. By avoiding the use of settings keys in place of date/time format settings, the vulnerability can be mitigated. Here is an example of how to set a valid date/time format in Django settings:
# settings.py
DATE_FORMAT = 'Y-m-d'
TIME_FORMAT = 'H:i:s'
Conclusion
The vulnerability in Django versions before 1.7.11, 1.8.7, and 1.9rc2 allows remote attackers to obtain sensitive application secrets, potentially leading to unauthorized access and data breaches. To mitigate this vulnerability, it is crucial to upgrade to the latest patched version of Django. If immediate upgrading is not possible, ensure that only valid date/time format settings are used in the application's configuration. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability allows remote attackers to obtain sensitive application secrets, such as the SECRET_KEY, which can lead to unauthorized access and potential data breaches. It is crucial to address this vulnerability promptly to protect the confidentiality and integrity of the application and its data.
This vulnerability affects Django versions before 1.7.11, 1.8.7, and 1.9rc2. If you are using any of these versions, it is recommended to upgrade to the latest patched version.
You can use the Vulert Playground at Vulert Scanner to check if your Django application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to address this vulnerability promptly to prevent potential exploitation and unauthorized access to sensitive information.
You can find more information about this vulnerability, including the technical details and the fixed versions of Django, in the official advisory at https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2015-11.yaml.
Related vulnerabilities
Recent vulnerabilities recorded for django.
