CVE-2021-3281
published 2021-02-02CVE-2021-3281: In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject…
PriorityP336medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
7.61%
93.8th percentile
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-django | < python-django 2:2.2.18-1 (bookworm) | python-django 2:2.2.18-1 (bookworm) |
| djangoproject | django | >= 2.2 < 2.2.18 | 2.2.18 |
| djangoproject | django | >= 2.2 < 2.2.18 | 2.2.18 |
| djangoproject | django | >= 3.0 < 3.0.12 | 3.0.12 |
| djangoproject | django | >= 3.0 < 3.0.12 | 3.0.12 |
| djangoproject | django | >= 3.1 < 3.1.6 | 3.1.6 |
| djangoproject | django | >= 3.1 < 3.1.6 | 3.1.6 |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Django Directory Traversal via archive.extract
osv·2021-03-18
CVE-2021-3281 [MEDIUM] Django Directory Traversal via archive.extract
Django Directory Traversal via archive.extract
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
GHSA
Django Directory Traversal via archive.extract
ghsa·2021-03-18
CVE-2021-3281 [MEDIUM] CWE-22 Django Directory Traversal via archive.extract
Django Directory Traversal via archive.extract
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
OSV
CVE-2021-3281: In Django 2
osv·2021-02-02·CVSS 5.3
CVE-2021-3281 [MEDIUM] CVE-2021-3281: In Django 2
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Red Hat
django: Potential directory-traversal via archive.extract()
vendor_redhat·2021-02-01·CVSS 5.3
CVE-2021-3281 [MEDIUM] CWE-22 django: Potential directory-traversal via archive.extract()
django: Potential directory-traversal via archive.extract()
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
A flaw was found in django where the`django.utils.archive.extract()` function, used by `startapp --template` and `startproject --template`, allowed directory-traversal via an archive with absolute paths or relative paths with dot segments.
Statement: The following products ship affected version of python-django, however the vulnerable function archive.extract() is currently not used in any part of the product and hence this issue has been rated as having a secur
Ubuntu
Django vulnerability
vendor_ubuntu·2021-02-01
CVE-2021-3281 Django vulnerability
Title: Django vulnerability
Summary: Django could be made to overwrite files.
USN-4715-1 fixed a vulnerability in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Wang Baohua discovered that Django incorrectly extracted archive files. A
remote attacker could possibly use this issue to extract files outside of
their expected location.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Django vulnerability
vendor_ubuntu·2021-02-01
CVE-2021-3281 Django vulnerability
Title: Django vulnerability
Summary: Django could be made to overwrite files.
Wang Baohua discovered that Django incorrectly extracted archive files. A
remote attacker could possibly use this issue to extract files outside of
their expected location.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2021-3281: python-django - In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django...
vendor_debian·2021·CVSS 5.3
CVE-2021-3281 [MEDIUM] CVE-2021-3281: python-django - In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django...
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Scope: local
bookworm: resolved (fixed in 2:2.2.18-1)
bullseye: resolved (fixed in 2:2.2.18-1)
forky: resolved (fixed in 2:2.2.18-1)
sid: resolved (fixed in 2:2.2.18-1)
trixie: resolved (fixed in 2:2.2.18-1)
No detection rules found.
No public exploits indexed.
https://docs.djangoproject.com/en/3.1/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/https://security.netapp.com/advisory/ntap-20210226-0004/https://www.djangoproject.com/weblog/2021/feb/01/security-releases/https://docs.djangoproject.com/en/3.1/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/https://security.netapp.com/advisory/ntap-20210226-0004/https://www.djangoproject.com/weblog/2021/feb/01/security-releases/
2021-02-02
Published