« Volver al listado

CVE-2026-54625

Estado: AplazadaMedia (4.8)—

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key.

Leer descripción completaMostrar menos

When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Django — CMSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-54625",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54625",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-20T19:45:03.782972Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "django-cms",
          "product": "django-cms",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.0.8"
            },
            {
              "status": "affected",
              "version": ">= 5.1.0a1, < 5.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-20T18:16:28.170",
  "references": [
    {
      "url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/django-cms/django-cms/pull/8646",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/django-cms/django-cms/pull/8647",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-349"
        },
        {
          "lang": "en",
          "value": "CWE-524"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0."
    }
  ],
  "lastModified": "2026-09-18T20:09:01.757",
  "sourceIdentifier": "security-advisories@github.com"
}