CVE-2018-1000089 django-anymail Includes Sensitive Information in Log Files
Attackers with access to error logs can discover webhook secrets to fabricate email tracking events in Django applications using Anymail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000089?
CVE-2018-1000089 is a high-severity vulnerability in n/a, published on 13 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.
Weakness: CWE-532
Which versions are affected by CVE-2018-1000089?
3 open source packages ship an affected version, including django-anymail. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
django-anymail PyPI | From 0.2 | 1.4 |
django-anymail PyPI | From 0.2 | 1.4 |
django-anymail PyPI | From 0.2 | 1.4 |
Products include Django-Anymail Project Django-Anymail.
How do I fix CVE-2018-1000089?
Upgrade django-anymail to 1.4 or later.
Is CVE-2018-1000089 being exploited?
There is no known exploitation of CVE-2018-1000089 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-1000089, GHSA-qh9x-mc42-vg4g, PYSEC-2018-46.