PT-2021-4548 · Django+4 · Django+4

Jasu Viding · Published 2021-05-04 · Updated 2026-01-03 · CVE-2021-31542

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 2.2 through 2.2.20 Django versions 3.1 through 3.1.8 Django versions 3.2 through 3.2.0

Description The issue is related to the lack of restrictions on file uploads in the Django web application platform, specifically in the MultiPartParser, UploadedFile, and FieldFile components. This can be exploited by a remote attacker to access confidential data using files with specially crafted names, allowing directory traversal via uploaded files.

Recommendations For Django versions 2.2 through 2.2.20, update to version 2.2.21 or later. For Django versions 3.1 through 3.1.8, update to version 3.1.9 or later. For Django versions 3.2 through 3.2.0, update to version 3.2.1 or later.

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

ALT-PU-2021-2228

ALT-PU-2021-3619

BDU:2021-05215

BIT-DJANGO-2021-31542

CVE-2021-31542

DLA-2651-1

DLA-3744-1

GHSA-RXJP-MFM9-W4WR

MGASA-2021-0356

OPENSUSE-SU-2024:11205-1

OPENSUSE-SU-2024:13887-1

OPENSUSE-SU-2024:14208-1

OPENSUSE-SU-2026:10005-1

PYSEC-2021-7

RHSA-2021:4702

RHSA-2021:5070

SUSE-SU-2021:1962-1

SUSE-SU-2021:1963-1

SUSE-SU-2021:2554-1

USN-4932-1

USN-4932-2

Affected Products

Alt Linux

Astra Linux

Django

Linuxmint

Ubuntu

References · 202

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14208-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05215 · Security Note
• https://osv.dev/vulnerability/USN-4932-2 · Vendor Advisory
• https://djangoproject.com/weblog/2021/may/04/security-releases · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-31542 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4932-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1963-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2554-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31542 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxjp-mfm9-w4wr · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9341.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3744-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31542 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory