medium5.3
CVE-2021-28658
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file…
Impact
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Djangoproject | Django | from 2.2 before 2.2.20 from 3.0 before 3.0.14 from 3.1 before 3.1.8 |
| Debian | Debian Linux | Version 9.0 |
| Fedoraproject | Fedora | Version 34 |
Weakness classification
References
- NVD record
- CVE.org record
- https://docs.djangoproject.com/en/3.1/releases/security/
- https://groups.google.com/g/django-announce/c/ePr5j-ngdPU
- https://lists.debian.org/debian-lts-announce/2021/04/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/
- https://security.netapp.com/advisory/ntap-20210528-0001/
- https://www.djangoproject.com/weblog/2021/apr/06/security-releases/
- https://docs.djangoproject.com/en/3.1/releases/security/
- https://groups.google.com/g/django-announce/c/ePr5j-ngdPU
- https://lists.debian.org/debian-lts-announce/2021/04/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/
- https://security.netapp.com/advisory/ntap-20210528-0001/
- https://www.djangoproject.com/weblog/2021/apr/06/security-releases/