CVE-2021-45452

· MEDIUMModified

← All CVEs

CVSS v3.1

5.3

EPSS

2.39%

Published

Jan 4, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-22

Affected Products (4)

djangoproject · django (up to 2.2.26)vulnerable

djangoproject · django (up to 3.2.11)vulnerable

djangoproject · django (up to 4.0.1)vulnerable

fedoraproject · fedoravulnerable

References (10)

https://docs.djangoproject.com/en/4.0/releases/security/

PatchVendor Advisory

https://groups.google.com/forum/#%21forum/django-announce

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/

https://security.netapp.com/advisory/ntap-20220121-0005/

Third Party Advisory

https://www.djangoproject.com/weblog/2022/jan/04/security-releases/

PatchVendor Advisory

https://docs.djangoproject.com/en/4.0/releases/security/

KEV Catalog EPSS Scores Vendors All CVEs