CVE-2021-28658

· MEDIUMModified

← All CVEs

CVSS v3.1

5.3

EPSS

3.86%

Published

Apr 6, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-22

Affected Products (5)

djangoproject · django (up to 2.2.20)vulnerable

djangoproject · django (up to 3.0.14)vulnerable

djangoproject · django (up to 3.1.8)vulnerable

debian · debian_linuxvulnerable

fedoraproject · fedoravulnerable

References (12)

https://docs.djangoproject.com/en/3.1/releases/security/

Vendor Advisory

https://groups.google.com/g/django-announce/c/ePr5j-ngdPU

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/04/msg00008.html

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/

https://security.netapp.com/advisory/ntap-20210528-0001/

Third Party Advisory

https://www.djangoproject.com/weblog/2021/apr/06/security-releases/

Vendor Advisory

https://docs.djangoproject.com/en/3.1/releases/security/

Vendor Advisory

https://groups.google.com/g/django-announce/c/ePr5j-ngdPU

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/04/msg00008.html

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/

https://security.netapp.com/advisory/ntap-20210528-0001/

Third Party Advisory

https://www.djangoproject.com/weblog/2021/apr/06/security-releases/

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs