onyx --cves cve-2021-31542
CVE-2021-31542
- score
- <0.1
- cvss
- 7.5
- epss
- 5.3%
- published
- 2021-05-05
- kev added
- —
- first seen
Django 2.2 < 2.2.21, 3.1 < 3.1.9, and 3.2 < 3.2.1 contain a path traversal caused by crafted file names in MultiPartParser, UploadedFile, and FieldFile, letting attackers access arbitrary files, exploit requires uploading files with malicious file names.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 11
- https://www.djangoproject.com/weblog/2021/may/04/security-releases/
- https://security.netapp.com/advisory/ntap-20210618-0001/
- https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://docs.djangoproject.com/en/3.2/releases/security/
- http://www.openwall.com/lists/oss-security/2021/05/04/3
- https://lists.debian.org/debian-lts-announce/2021/05/msg00005.html
- https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48
- https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/