PT-2020-5504 · Django Software Foundation+4 · Django+4

Published 2020-09-01 · Updated 2026-01-03 · CVE-2020-24583

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 2.2 through 2.2.15 Django versions 3.0 through 3.0.9 Django versions 3.1 through 3.1.0

Description The issue is related to the incorrect application of the FILE UPLOAD DIRECTORY PERMISSIONS mode in Django, specifically to intermediate-level directories created during file uploads and to collected static directories when using the collectstatic management command. This could potentially allow a remote attacker to disclose protected information due to incorrect default permission settings.

Recommendations For Django versions 2.2 through 2.2.15, update to version 2.2.16 or later. For Django versions 3.0 through 3.0.9, update to version 3.0.10 or later. For Django versions 3.1 through 3.1.0, update to version 3.1.1 or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ALT-PU-2020-3491

BDU:2021-00881

BDU:2021-00936

BIT-DJANGO-2020-24583

CVE-2020-24583

DLA-3164-1

GHSA-M6GJ-H9GM-GW44

OPENSUSE-SU-2024:11205-1

OPENSUSE-SU-2024:13887-1

OPENSUSE-SU-2024:14208-1

OPENSUSE-SU-2026:10005-1

PYSEC-2020-33

USN-4479-1

Affected Products

Alt Linux

Astra Linux

Django

Linuxmint

Ubuntu

References · 116

• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20241017SE16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24583 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14208-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24583 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6gj-h9gm-gw44 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00936 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24584 · Vendor Advisory
• https://djangoproject.com/weblog/2020/sep/01/security-releases · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/09/01/2 · Patch
• https://ubuntu.com/security/CVE-2020-24583 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2021.html · Patch