CyberRota Analysis
AI-GeneratedThe Django REST Framework prior to version 3.17.2 contains a vulnerability in the AdminRenderer that allows unauthorized data exposure during the rendering of invalid write requests, as it bypasses necessary permission checks. This could lead to the disclosure of sensitive information from GET representations to users who should not have access. Organizations using affected versions of the Django REST Framework should prioritize upgrading to version 3.17.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.