Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-45452

Good to know:

icon
icon

Date: January 4, 2022

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

Language: Python

Severity Score

Related Resources (19)

https://github.com/django/django/commit/8d2f7cff76200cbd2337b2cf1707e383eb1fb54b
https://docs.djangoproject.com/en/4.0/releases/security
https://github.com/advisories/GHSA-jrh2-hc4r-7jwx
https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
https://github.com/django/django/commit/4cb35b384ceef52123fc66411a73c36a706825e1
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-3.yaml
https://github.com/django/django
https://security.netapp.com/advisory/ntap-20220121-0005/
https://github.com/django/django/commit/e1592e0f26302e79856cc7f2218ae848ae19b0f6
https://docs.djangoproject.com/en/4.0/releases/security/
https://www.djangoproject.com/weblog/2022/jan/04/security-releases
https://security.netapp.com/advisory/ntap-20220121-0005
https://groups.google.com/forum/#!forum/django-announce
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
https://nvd.nist.gov/vuln/detail/CVE-2021-45452
https://groups.google.com/forum/#%21forum/django-announce
https://security-tracker.debian.org/tracker/CVE-2021-45452
https://www.mend.io/vulnerability-database/CVE-2021-45452

Severity Score

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

Top Fix

icon

Upgrade Version

Upgrade to version django - 2.2.26;django - 3.2.11;django - 4.0.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us