PYSEC-2021-98
Vulnerability from pysec - Published: 2021-06-08 18:15 - Updated: 2021-06-22 04:54
VLAI?
Details
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
Impacted products
| Name | purl | django | pkg:pypi/django |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django",
"purl": "pkg:pypi/django"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.24"
},
{
"introduced": "3.0"
},
{
"fixed": "3.1.12"
},
{
"introduced": "3.2"
},
{
"fixed": "3.2.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.1",
"1.0.2",
"1.0.3",
"1.0.4",
"1.1",
"1.1.1",
"1.1.2",
"1.1.3",
"1.1.4",
"1.10",
"1.10.1",
"1.10.2",
"1.10.3",
"1.10.4",
"1.10.5",
"1.10.6",
"1.10.7",
"1.10.8",
"1.10a1",
"1.10b1",
"1.10rc1",
"1.11",
"1.11.1",
"1.11.10",
"1.11.11",
"1.11.12",
"1.11.13",
"1.11.14",
"1.11.15",
"1.11.16",
"1.11.17",
"1.11.18",
"1.11.2",
"1.11.20",
"1.11.21",
"1.11.22",
"1.11.23",
"1.11.24",
"1.11.25",
"1.11.26",
"1.11.27",
"1.11.28",
"1.11.29",
"1.11.3",
"1.11.4",
"1.11.5",
"1.11.6",
"1.11.7",
"1.11.8",
"1.11.9",
"1.11a1",
"1.11b1",
"1.11rc1",
"1.2",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.2.5",
"1.2.6",
"1.2.7",
"1.3",
"1.3.1",
"1.3.2",
"1.3.3",
"1.3.4",
"1.3.5",
"1.3.6",
"1.3.7",
"1.4",
"1.4.1",
"1.4.10",
"1.4.11",
"1.4.12",
"1.4.13",
"1.4.14",
"1.4.15",
"1.4.16",
"1.4.17",
"1.4.18",
"1.4.19",
"1.4.2",
"1.4.20",
"1.4.21",
"1.4.22",
"1.4.3",
"1.4.4",
"1.4.5",
"1.4.6",
"1.4.7",
"1.4.8",
"1.4.9",
"1.5",
"1.5.1",
"1.5.10",
"1.5.11",
"1.5.12",
"1.5.2",
"1.5.3",
"1.5.4",
"1.5.5",
"1.5.6",
"1.5.7",
"1.5.8",
"1.5.9",
"1.6",
"1.6.1",
"1.6.10",
"1.6.11",
"1.6.2",
"1.6.3",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"1.7",
"1.7.1",
"1.7.10",
"1.7.11",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"1.7.9",
"1.8",
"1.8.1",
"1.8.10",
"1.8.11",
"1.8.12",
"1.8.13",
"1.8.14",
"1.8.15",
"1.8.16",
"1.8.17",
"1.8.18",
"1.8.19",
"1.8.2",
"1.8.3",
"1.8.4",
"1.8.5",
"1.8.6",
"1.8.7",
"1.8.8",
"1.8.9",
"1.8a1",
"1.8b1",
"1.8b2",
"1.8c1",
"1.9",
"1.9.1",
"1.9.10",
"1.9.11",
"1.9.12",
"1.9.13",
"1.9.2",
"1.9.3",
"1.9.4",
"1.9.5",
"1.9.6",
"1.9.7",
"1.9.8",
"1.9.9",
"1.9a1",
"1.9b1",
"1.9rc1",
"1.9rc2",
"2.0",
"2.0.1",
"2.0.10",
"2.0.12",
"2.0.13",
"2.0.2",
"2.0.3",
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"2.0.8",
"2.0.9",
"2.0a1",
"2.0b1",
"2.0rc1",
"2.1",
"2.1.1",
"2.1.10",
"2.1.11",
"2.1.12",
"2.1.13",
"2.1.14",
"2.1.15",
"2.1.2",
"2.1.3",
"2.1.4",
"2.1.5",
"2.1.7",
"2.1.8",
"2.1.9",
"2.1a1",
"2.1b1",
"2.1rc1",
"2.2",
"2.2.1",
"2.2.10",
"2.2.11",
"2.2.12",
"2.2.13",
"2.2.14",
"2.2.15",
"2.2.16",
"2.2.17",
"2.2.18",
"2.2.19",
"2.2.2",
"2.2.20",
"2.2.21",
"2.2.22",
"2.2.23",
"2.2.3",
"2.2.4",
"2.2.5",
"2.2.6",
"2.2.7",
"2.2.8",
"2.2.9",
"2.2a1",
"2.2b1",
"2.2rc1",
"3.0",
"3.0.1",
"3.0.10",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.14",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1",
"3.1.1",
"3.1.10",
"3.1.11",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.7",
"3.1.8",
"3.1.9",
"3.1a1",
"3.1b1",
"3.1rc1",
"3.2",
"3.2.1",
"3.2.2",
"3.2.3"
]
}
],
"aliases": [
"CVE-2021-33203",
"GHSA-68w8-qjq3-2gfm"
],
"details": "Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.",
"id": "PYSEC-2021-98",
"modified": "2021-06-22T04:54:55.381670Z",
"published": "2021-06-08T18:15:00Z",
"references": [
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/3.2/releases/security/"
},
{
"type": "ARTICLE",
"url": "https://www.djangoproject.com/weblog/2021/jun/02/security-releases/"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!forum/django-announce"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-68w8-qjq3-2gfm"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…