Directory-traversal in Django
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-45452US | medium5.3 | — | ||
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.djangoproject.com/en/4.0/releases/securityWEB
- https://github.com/advisories/GHSA-jrh2-hc4r-7jwxADVISORY
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/4cb35b384ceef52123fc66411a73c36a706825e1WEB
- https://github.com/django/django/commit/8d2f7cff76200cbd2337b2cf1707e383eb1fb54bWEB
- https://github.com/django/django/commit/e1592e0f26302e79856cc7f2218ae848ae19b0f6WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-3.yamlWEB
- https://groups.google.com/forum/#!forum/django-announceWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan