CVE-2021-45452

django: Potential directory-traversal via Storage.save()

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

CVSS 3.1 · 5.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Satellite and 1 more

CVE-2021-45115

django: Denial-of-service possibility in UserAttributeSimilarityValidator

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Satellite and 1 more

CVE-2021-44420

django: potential bypass of an upstream access control based on URL paths

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

CVSS 3.1 · 7.3 High EPSS 2.4% KEV · Not listed

Vendors

Canonical Debian Djangoproject and 2 more

Products

Ubuntu Linux Debian Linux Django and 4 more

CVE-2021-3281

django: Potential directory-traversal via archive.extract()

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

CVSS 3.1 · 5.3 Medium EPSS 7.6% KEV · Not listed

Vendors

Djangoproject Fedoraproject Netapp and 1 more

Products

Django Fedora Snapcenter and 2 more

CVE-2021-35042

django: potential SQL injection via unsanitized QuerySet.order_by() input

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

CVSS 3.1 · 9.8 Critical EPSS 44.4% KEV · Not listed

Vendors

Djangoproject Fedoraproject

Products

Django Fedora

CVE-2021-33571

django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Openstack and 2 more

CVE-2021-33203

django: Potential directory traversal via ``admindocs``

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

CVSS 3.1 · 4.9 Medium EPSS 2.7% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Openstack and 2 more

CVE-2021-32052

django: header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.

CVSS 3.1 · 6.1 Medium EPSS 3.2% KEV · Not listed

Vendors

Djangoproject Fedoraproject Python

Products

Django Fedora Python

CVE-2021-31542

django: Potential directory-traversal via uploaded files

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Debian Djangoproject Fedoraproject and 1 more

Products

Debian Linux Django Fedora and 3 more

CVE-2021-28658

django: potential directory-traversal via uploaded files

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS 3.8% KEV · Not listed

Vendors

Debian Djangoproject Fedoraproject and 1 more

Products

Debian Linux Django Fedora and 3 more

CVE-2020-9402

django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

CVSS 3.1 · 8.8 High EPSS 24.0% KEV · Not listed

Vendors

Canonical Debian Djangoproject and 3 more

Products

Ubuntu Linux Debian Linux Django and 4 more

CVE-2020-7471

django: potential SQL injection via StringAgg(delimiter)

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

CVSS 3.1 · 9.8 Critical EPSS 65.6% KEV · Not listed

Vendors

Djangoproject

Products

Django

CVE-2020-35681

django-channels: potential leakage of session identifiers using legacy AsgiHandler

Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0.

CVSS 3.1 · 7.4 High EPSS 2.7% KEV · Not listed

Vendors

Djangoproject

Products

Channels

CVE-2020-24584

django: permission escalation in intermediate-level directories of the file system cache on Python 3.7+

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed

Vendors

Canonical Djangoproject Fedoraproject and 1 more

Products

Ubuntu Linux Django Fedora and 1 more

CVE-2020-24583

django: incorrect permissions on intermediate-level directories on Python 3.7+

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Canonical Djangoproject Fedoraproject and 1 more

Products

Ubuntu Linux Django Fedora and 1 more

CVE-2020-13596

django: possible XSS via admin ForeignKeyRawIdWidget

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS 2.9% KEV · Not listed

Vendors

Canonical Debian Djangoproject and 3 more

Products

Ubuntu Linux Debian Linux Django and 4 more

CVE-2020-13254

django: potential data leakage via malformed memcached keys

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

CVSS 3.1 · 5.9 Medium EPSS 6.1% KEV · Not listed

Vendors

Canonical Debian Djangoproject and 4 more

Products

Ubuntu Linux Debian Linux Django and 5 more

CVE-2019-6975

python-django: memory exhaustion in django.utils.numberformat.format()

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Canonical Djangoproject Fedoraproject

Products

Ubuntu Linux Django Fedora

CVE-2019-3498

python-django: Content spoofing via URL path in default 404 page

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

CVSS 3.0 · 6.5 Medium EPSS 3.4% KEV · Not listed

Vendors

Canonical Debian Djangoproject and 1 more

Products

Ubuntu Linux Debian Linux Django and 1 more

CVE-2019-19844

Django: crafted email address allows account takeover

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

CVSS 3.1 · 9.8 Critical EPSS 53.6% KEV · Not listed

Vendors

Canonical Djangoproject

Products

Ubuntu Linux Django