Vulnerability DatabaseCVE-2021-3281
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2021-3281
February 02, 2021
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Affected Packages
Django (PYTHON):
Affected version(s)
Fix Suggestion:
Update to version 3.0.12
Django (PYTHON):
Affected version(s)
Fix Suggestion:
Update to version 2.2.18
Django (PYTHON):
Affected version(s)
Fix Suggestion:
Update to version 3.1.6
Related Resources (20)
https://github.com/django/django/commit/05413afa8c18cdb978fcdf470e09f7a12b234a23
https://docs.djangoproject.com/en/3.1/releases/3.0.12
https://groups.google.com/forum/#%21forum/django-announce
https://docs.djangoproject.com/en/3.1/releases/security
https://www.djangoproject.com/weblog/2021/feb/01/security-releases
https://www.djangoproject.com/weblog/2021/feb/01/security-releases/
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-9.yaml
https://github.com/django/django/commit/52e409ed17287e9aabda847b6afe58be2fa9f86a
https://github.com/django/django/commit/21e7622dec1f8612c85c2fc37fe8efbfd3311e37
https://github.com/django/django
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO
https://security.netapp.com/advisory/ntap-20210226-0004
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
https://github.com/advisories/GHSA-fvgf-6h6h-3322
https://nvd.nist.gov/vuln/detail/CVE-2021-3281
https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef435f624
https://security.netapp.com/advisory/ntap-20210226-0004/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
https://docs.djangoproject.com/en/3.1/releases/security/
https://groups.google.com/forum/#!forum/django-announce
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
CVSS v2
Base Score:
5
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
Weakness Type (CWE)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22
EPSS
Base Score:
36.23