onyx --cves cve-2020-24583
CVE-2020-24583
- score
- <0.1
- cvss
- 7.5
- epss
- 4.0%
- published
- 2020-09-01
- kev added
- —
- first seen
Django 2.2 < 2.2.16, 3.0 < 3.0.10, and 3.1 < 3.1.1 (with Python 3.7+) contain a permissions misconfiguration caused by not applying FILE_UPLOAD_DIRECTORY_PERMISSIONS to intermediate directories during file uploads and static collection, letting attackers potentially access or modify files, exploit requires file upload or static collection process.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 11
- https://docs.djangoproject.com/en/dev/releases/security/
- https://security.netapp.com/advisory/ntap-20200918-0004/
- https://www.openwall.com/lists/oss-security/2020/09/01/2
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://groups.google.com/forum/#%21topic/django-announce/Gdqn58RqIDM
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI/
- https://www.djangoproject.com/weblog/2020/sep/01/security-releases/
- https://usn.ubuntu.com/4479-1/
- https://groups.google.com/forum/#%21topic/django-announce/zFCMdgUnutU
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU/