PT-2013-4954 · Django · Django

Rainer Koirikivi · Published 2013-09-16 · Updated 2022-05-17 · CVE-2013-4315

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.6 Django versions 1.5.x through 1.5.2 Django versions 1.6.x through 1.6 beta 2

Description The issue allows remote attackers to read arbitrary files via a file path in the ALLOWED INCLUDE ROOTS setting followed by a .. (dot dot) in a ssi template tag. This is a directory traversal vulnerability.

Recommendations For Django versions 1.4.x through 1.4.6, update to version 1.4.7 or later. For Django versions 1.5.x through 1.5.2, update to version 1.5.3 or later. For Django versions 1.6.x through 1.6 beta 2, update to version 1.6 beta 3 or later. As a temporary workaround, consider restricting access to the ALLOWED INCLUDE ROOTS setting and ssi template tags to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-4315

DSA-2755-1

GHSA-VJJP-9R83-22RC

MGASA-2013-0283

MGASA-2013-0284

PYSEC-2013-20

RHSA-2013:1521

Affected Products

Django

References · 23

• https://advisories.mageia.org/MGASA-2013-0283.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4315 · Vendor Advisory
• http://secunia.com/advisories/54772 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1521.html · Vendor Advisory
• http://secunia.com/advisories/54828 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4315 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4315 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0284 · Vendor Advisory
• https://djangoproject.com/weblog/2013/sep/10/security-releases-issued · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4315 · Security Note
• http://debian.org/security/2013/dsa-2755 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-20 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vjjp-9r83-22rc · Vendor Advisory