CVE-2018-25111

Description

django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.

How to fix CVE-2018-25111

To remediate CVE-2018-25111, upgrade the affected package to a fixed version below.

• PyPI/django-helpdesk—upgrade to 1.0.0 or later
• PyPI/django-helpdesk—upgrade to 0d91fcca0b6a98a4e7248368bc1dc4f06c682159 or later

Is CVE-2018-25111 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 1.0.0
• from 0, < 0d91fcca0b6a98a4e7248368bc1dc4f06c682159 | from 0, < 1.0.0

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-m4jx-m5hg-qrxx
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-25111
• PATCHgithub.com/django-helpdesk/django-helpdesk
• WEBgithub.com/django-helpdesk/django-helpdesk/commit/f872ec252769bee5a88b06d07d3634e580c67bcc