PT-2009-5055 · Django · Django

Josh Bressers · Publicado 2009-08-04 · Atualizado 2022-05-02 · CVE-2009-2659

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 0.96 through 1.0

Description The issue arises from the Admin media handler in core/servers/basehttp.py, which fails to properly map URL requests to expected static media files. This allows remote attackers to conduct directory traversal attacks, enabling them to read arbitrary files via a crafted URL.

Recommendations For Django versions 0.96 through 1.0, consider restricting access to the Admin media handler until a proper fix is applied, focusing on securing the core/servers/basehttp.py module to prevent directory traversal attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-2659

GHSA-9XG7-GG9M-RMQ9

PYSEC-2009-3

Produtos afetados

Django

Referências · 20

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/da85d76fd6ca846f3b0ff414e042ddb5e62e2e69 · Nota
• https://github.com/django/django/commit/df7f917b7f51ba969faa49d000ffc79572c5dcb4 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-3.yaml · Nota
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00055.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00069.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2659 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9xg7-gg9m-rmq9 · Aviso do Fabricante
• http://code.djangoproject.com/changeset/11353 · Nota
• https://osv.dev/vulnerability/CVE-2009-2659 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2009/07/29/2 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539134 · Nota
• http://djangoproject.com/weblog/2009/jul/28/security · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-2659 · Aviso do Fabricante
• https://web.archive.org/web/20111211001428/http://securityfocus.com/bid/35859 · Nota