CVE-2007-0404 — Django vulnerability
6 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.7%
top 28.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 23
Latest updateMay 1
Description
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.
CVSS vector
AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4
Affected Packages2 packages
Patches
🔴Vulnerability Details
4📋Vendor Advisories
1Debian▶
CVE-2007-0404: python-django - bin/compile-messages.py in Django 0.95 does not quote argument strings before in...↗2007