django-anymail Includes Sensitive Information in Log Files

Also known as GHSA-qh9x-mc42-vg4g, PYSEC-2018-46

Published 8 y ago 2018-03-13 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.4

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.2%

percentile 69%

Public exploits

none known

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.

Exploit prediction (EPSS)

1.22% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.4	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`
GitHub	3.0	7.4	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`django-anymail`	>=0.2, <1.4	1.4

Classification

Weakness

CWE-532 Insertion of Sensitive Information into Log File

References

github.com /anymail/django-anymail/commit/1a6086f2b58478d71f89bf27eb034ed81aefe5ef · x_refsource_MISC, x_transferred
github.com /anymail/django-anymail/releases/tag/v1.4 · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-1000089 · advisory
github.com /advisories/GHSA-qh9x-mc42-vg4g · advisory
github.com /anymail/django-anymail · package
github.com /pypa/advisory-database/tree/main/vulns/django-anymail/PYSEC-2018-46.yaml · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.