Vulnerabilities

TI-2018-15744 CVE-2018-1000089 · GHSA-qh9x-mc42-vg4g

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209…

LOW 35

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email track…

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.01219 Published 2018-03-13 Fixed in 1.4 CWE-532

TI-2018-04862 CVE-2018-6596 · GHSA-hxf9-7h4c-f5jv

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack…

MEDIUM 44

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.02609 Published 2018-02-03 Fixed in 1.2.1 CWE-200

Vulnerabilities

Filters

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209…

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack…