GitHub Advisoryadvisory · PyPI

GHSA-9xg7-gg9m-rmq9 Django Admin Media Handler Vulnerable to Directory Traversal

HIGH Published 2022-05-02 Modified 2024-09-16 Official page ↗
Aliases
CVE-2009-2659
Ecosystem
PyPI
Packages
Django
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-02-08

Affected packages

• PyPI Django: >= 0.96.0, < 0.96.4 → fixed in 0.96.4 • PyPI Django: >= 1.0, < 1.0.3 → fixed in 1.0.3

Description

The Admin media handler in `core/servers/basehttp.py` in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.

Related

Alias · CVE (1)

  • CVE-2009-2659 The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References