Django Tastypie
Monthly
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.