CVE-2021-45452
published 2022-01-05CVE-2021-45452: Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
2.39%
81.8th percentile
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-django | < python-django 2:3.2.11-1 (bookworm) | python-django 2:3.2.11-1 (bookworm) |
| djangoproject | django | >= 2.2 < 2.2.26 | 2.2.26 |
| djangoproject | django | >= 2.2 < 2.2.26 | 2.2.26 |
| djangoproject | django | >= 3.2 < 3.2.11 | 3.2.11 |
| djangoproject | django | >= 3.2 < 3.2.11 | 3.2.11 |
| djangoproject | django | >= 4.0 < 4.0.1 | 4.0.1 |
| djangoproject | django | >= 4.0 < 4.0.1 | 4.0.1 |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Directory-traversal in Django
ghsa·2022-01-12
CVE-2021-45452 [MEDIUM] CWE-22 Directory-traversal in Django
Directory-traversal in Django
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
OSV
Directory-traversal in Django
osv·2022-01-12
CVE-2021-45452 [MEDIUM] Directory-traversal in Django
Directory-traversal in Django
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
OSV
CVE-2021-45452: Storage
osv·2022-01-05·CVSS 5.3
CVE-2021-45452 [MEDIUM] CVE-2021-45452: Storage
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
OSV
python-django vulnerabilities
osv·2022-01-05·CVSS 7.5
CVE-2021-45115 [HIGH] python-django vulnerabilities
python-django vulnerabilities
Chris Bailey discovered that Django incorrectly handled evaluating
submitted passwords. A remote attacker could possibly use this issue to
consume resources, resulting in a denial of service. (CVE-2021-45115)
Dennis Brinkrolf discovered that Django incorrectly handled the dictsort
template filter. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2021-45116)
Dennis Brinkrolf discovered that Django incorrectly handled certain file
names. A remote attacker could possibly use this issue to save files to
arbitrary filesystem locations. (CVE-2021-45452)
Ubuntu
Django vulnerabilities
vendor_ubuntu·2022-01-05·CVSS 7.5
CVE-2021-45116 [HIGH] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
Chris Bailey discovered that Django incorrectly handled evaluating
submitted passwords. A remote attacker could possibly use this issue to
consume resources, resulting in a denial of service. (CVE-2021-45115)
Dennis Brinkrolf discovered that Django incorrectly handled the dictsort
template filter. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2021-45116)
Dennis Brinkrolf discovered that Django incorrectly handled certain file
names. A remote attacker could possibly use this issue to save files to
arbitrary filesystem locations. (CVE-2021-45452)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
django: Potential directory-traversal via Storage.save()
vendor_redhat·2022-01-04·CVSS 5.3
CVE-2021-45452 [MEDIUM] CWE-22 django: Potential directory-traversal via Storage.save()
django: Potential directory-traversal via Storage.save()
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
A directory-traversal flaw was found in Django's Storage.save() method, where a network attacker could possibly traverse restricted paths using suitably crafted file names.
Statement: In Red Hat OpenStack Platform, because the flaw's impact is lower and the impacted functionality is not directly used, no update will be provided at this time for the python-django20 package.
Package: python-django (Red Hat Ansible Automation Platform 1.2) - Affected
Package: python-django (Red Hat Ansible Automation Platform 2) - Affected
Package: django (Red Hat Ansible Tower 3) - Affected
Debian
CVE-2021-45452: python-django - Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0....
vendor_debian·2021·CVSS 5.3
CVE-2021-45452 [MEDIUM] CVE-2021-45452: python-django - Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0....
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
Scope: local
bookworm: resolved (fixed in 2:3.2.11-1)
bullseye: resolved (fixed in 2:2.2.26-1~deb11u1)
forky: resolved (fixed in 2:3.2.11-1)
sid: resolved (fixed in 2:3.2.11-1)
trixie: resolved (fixed in 2:3.2.11-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.djangoproject.com/en/4.0/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20220121-0005/https://www.djangoproject.com/weblog/2022/jan/04/security-releases/https://docs.djangoproject.com/en/4.0/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20220121-0005/https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
2022-01-05
Published