GitHub Advisoryadvisory · PyPI
GHSA-r3xc-prgr-mg9p Django bypasses validation when using one form field to upload multiple files
CRITICAL
Official page ↗
- Aliases
- CVE-2023-31047
- Ecosystem
- PyPI
- Packages
- Django
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2023-05-09
Affected packages
• PyPI Django: >= 3.2a1, < 3.2.19 → fixed in 3.2.19
• PyPI Django: >= 4.0a1, < 4.1.9 → fixed in 4.1.9
• PyPI Django: >= 4.2a1, < 4.2.1 → fixed in 4.2.1
Description
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Related
Alias · CVE (1)
- CVE-2023-31047 In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-31047 advisory
- https://github.com/django/django/commit/21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd web
- https://github.com/django/django/commit/e7c3a2ccc3a562328600be05068ed9149e12ce64 web
- https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965 web
- https://docs.djangoproject.com/en/4.2/releases/security web
- https://github.com/django/django package
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-61.yaml web
- https://groups.google.com/forum/#!forum/django-announce web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD web
- https://security.netapp.com/advisory/ntap-20230609-0008 web
- https://www.djangoproject.com/weblog/2023/may/03/security-releases web