CVE-2018-1000089: Inclusion of Sensitive Information in Log Files
(updated )
django-anymail contains a vulnerability in the WEBHOOK_AUTHORIZATION
setting. An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK
setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app.
References
Detect and mitigate CVE-2018-1000089 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →