PT-2020-5498 · Django Software Foundation+4 · Django+4

Published 2020-09-01 · Updated 2026-01-03 · CVE-2020-24584

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Django versions 2.2 through 2.2.15 Django versions 3.0 through 3.0.9 Django versions 3.1 through 3.1.0

Description The issue is related to incorrect default permission settings in the Django web application platform. This could allow a remote attacker to disclose protected information. The problem arises from the intermediate-level directories of the filesystem cache having the system's standard umask rather than 0o077.

Recommendations For Django versions 2.2 through 2.2.15, update to version 2.2.16 or later. For Django versions 3.0 through 3.0.9, update to version 3.0.10 or later. For Django versions 3.1 through 3.1.0, update to version 3.1.1 or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ALT-PU-2020-3491

BDU:2021-00881

BIT-DJANGO-2020-24584

CVE-2020-24584

DLA-3164-1

GHSA-FR28-569J-53C4

OPENSUSE-SU-2024:11205-1

OPENSUSE-SU-2024:13887-1

OPENSUSE-SU-2024:14208-1

OPENSUSE-SU-2026:10005-1

PYSEC-2020-34

USN-4479-1

Affected Products

Alt Linux

Astra Linux

Django

Linuxmint

Ubuntu

References · 119

• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20241017SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14208-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24584 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-24584 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24584 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-24584 · Security Note
• https://djangoproject.com/weblog/2020/sep/01/security-releases · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/09/01/2 · Patch
• https://ubuntu.com/security/CVE-2020-24583 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU · Vendor Advisory
• https://osv.dev/vulnerability/BIT-django-2020-24584 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2021.html · Patch