Описание
Directory-traversal in Django
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2021-45452
- https://github.com/django/django/commit/4cb35b384ceef52123fc66411a73c36a706825e1
- https://github.com/django/django/commit/8d2f7cff76200cbd2337b2cf1707e383eb1fb54b
- https://github.com/django/django/commit/e1592e0f26302e79856cc7f2218ae848ae19b0f6
- https://docs.djangoproject.com/en/4.0/releases/security
- https://github.com/advisories/GHSA-jrh2-hc4r-7jwx
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-3.yaml
- https://groups.google.com/forum/#!forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
- https://security.netapp.com/advisory/ntap-20220121-0005
- https://www.djangoproject.com/weblog/2022/jan/04/security-releases
Пакеты
Django
>= 2.2, < 2.2.26
2.2.26
Django
>= 3.2, < 3.2.11
3.2.11
Django
>= 4.0, < 4.0.1
4.0.1
Связанные уязвимости
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 b ...
Уязвимость функция Storage.save() фреймворка для веб-приложений Django, позволяющая нарушителю получить доступ к конфиденциальной информации