Описание
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 3:5.2.4-1ubuntu2 |
| esm-infra-legacy/trusty | released | 1.6.11-0ubuntu1.3+esm8 |
| esm-infra/bionic | released | 1:1.11.11-1ubuntu1.21+esm12 |
| esm-infra/focal | released | 2:2.2.12-1ubuntu0.29+esm4 |
| esm-infra/xenial | released | 1.8.7-1ubuntu5.15+esm9 |
| jammy | released | 2:3.2.12-2ubuntu1.22 |
| noble | released | 3:4.2.11-1ubuntu1.11 |
| plucky | released | 3:4.2.18-1ubuntu1.5 |
| questing | released | 3:5.2.4-1ubuntu2 |
| upstream | released | 4.2.25,5.1.13,5.2.7 |
Показывать по
3.1 Low
CVSS3
Связанные уязвимости
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13 ...
Django vulnerable to partial directory traversal via archives
Уязвимость функции django.utils.archive.extract() программной платформы для веб-приложений Django, позволяющая нарушителю обойти ограничения безопасности
3.1 Low
CVSS3