CVE-2020-24584 — Incorrect Default Permissions in Django

CWE-276 — Incorrect Default Permissions13 documents8 sources
Severity
7.5HIGHNVD
EPSS
3.3%
top 12.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Djangoproject DjangoCanonical Ubuntu LinuxFedoraproject Fedora+1 more
Timeline
PublishedSep 1
Latest updateMar 18

Description

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDdjangoproject/django2.2 — 2.2.16+2
▶PyPIdjangoproject/django2.2 — 2.2.16+2

Also affects: Fedora 31, 32, 33, Ubuntu Linux 20.04

Patches

Patch: www.openwall.com ↗Patch: www.oracle.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

4
GHSA
Django Incorrect Default Permissions↗2021-03-18
▶
OSV
Django Incorrect Default Permissions↗2021-03-18
▶
OSV
CVE-2020-24584: An issue was discovered in Django 2↗2020-09-01
▶
CVEList
CVE-2020-24584: An issue was discovered in Django 2↗2020-09-01
▶

📋Vendor Advisories

3
Ubuntu
Django vulnerabilities↗2020-09-01
▶
Red Hat
django: permission escalation in intermediate-level directories of the file system cache on Python 3.7+↗2020-09-01
▶
Debian
CVE-2020-24584: python-django - An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 ...↗2020
▶

💬Community

5
Bugzilla
CVE-2020-24584 django: permission escalation in intermediate-level directories of the file system cache on Python 3.7+↗2020-09-01
▶
Bugzilla
CVE-2020-24584 python-django: django: permission escalation in intermediate-level directories of the file system cache on Python 3.7+ [openstack-rdo]↗2020-09-01
▶
Bugzilla
CVE-2020-24584 python-django: django: permission escalation in intermediate-level directories of the file system cache on Python 3.7+ [fedora-all]↗2020-09-01
▶
Bugzilla
CVE-2020-24584 python-django: django: permission escalation in intermediate-level directories of the file system cache on Python 3.7+ [epel-all]↗2020-09-01
▶
Bugzilla
CVE-2020-24584 django:1.6/python-django: django: permission escalation in intermediate-level directories of the file system cache on Python 3.7+ [fedora-all]↗2020-09-01
▶
CVE-2020-24584 — Incorrect Default Permissions | cvebase