onyx --cves cve-2023-31047
CVE-2023-31047
- score
- <0.1
- cvss
- 9.8
- epss
- 1.4%
- published
- 2023-05-07
- kev added
- —
- first seen
Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1 contain a validation bypass caused by improper handling of multiple file uploads in a single form field, letting attackers upload multiple files bypassing validation, exploit requires using the form with multiple file uploads.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 6
- https://security.netapp.com/advisory/ntap-20230609-0008/
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://www.djangoproject.com/weblog/2023/may/03/security-releases/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD/