Описание
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 1:1.11.11-1ubuntu1.13 |
| devel | released | 2:2.2.20-1ubuntu0.1 |
| esm-infra-legacy/trusty | not-affected | 1.6.11-0ubuntu1.3+esm3 |
| esm-infra/bionic | not-affected | 1:1.11.11-1ubuntu1.13 |
| esm-infra/focal | not-affected | 2:2.2.12-1ubuntu0.6 |
| esm-infra/xenial | released | 1.8.7-1ubuntu5.15+esm1 |
| focal | released | 2:2.2.12-1ubuntu0.6 |
| groovy | released | 2:2.2.16-1ubuntu0.4 |
| hirsute | released | 2:2.2.20-1ubuntu0.1 |
| impish | released | 2:2.2.20-1ubuntu0.1 |
Показывать по
5 Medium
CVSS2
7.5 High
CVSS3
Связанные уязвимости
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, M ...
Уязвимость компонентов MultiPartParser, UploadedFile, FieldFile программной платформы для веб-приложений Django, связанная с отсутствием ограничений на загрузку файлов, позволяющая нарушителю получить доступ к конфиденциальным данным
5 Medium
CVSS2
7.5 High
CVSS3