PT-2009-5055 · Django · Django

Josh Bressers · Published 2009-08-04 · Updated 2022-05-02 · CVE-2009-2659

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 0.96 through 1.0

Description The issue arises from the Admin media handler in core/servers/basehttp.py, which fails to properly map URL requests to expected static media files. This allows remote attackers to conduct directory traversal attacks, enabling them to read arbitrary files via a crafted URL.

Recommendations For Django versions 0.96 through 1.0, consider restricting access to the Admin media handler until a proper fix is applied, focusing on securing the core/servers/basehttp.py module to prevent directory traversal attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-2659

GHSA-9XG7-GG9M-RMQ9

PYSEC-2009-3

Affected Products

Django

References · 20

• https://redhat.com/archives/fedora-package-announce/2009-August/msg00055.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00069.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2659 · Security Note
• https://osv.dev/vulnerability/GHSA-9xg7-gg9m-rmq9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-2659 · Vendor Advisory
• http://djangoproject.com/weblog/2009/jul/28/security · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2659 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2659 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2009-3 · Vendor Advisory
• https://github.com/django/django · Note
• https://github.com/django/django/commit/da85d76fd6ca846f3b0ff414e042ddb5e62e2e69 · Note
• https://github.com/django/django/commit/df7f917b7f51ba969faa49d000ffc79572c5dcb4 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-3.yaml · Note
• http://code.djangoproject.com/changeset/11353 · Note
• http://openwall.com/lists/oss-security/2009/07/29/2 · Note