PT-2022-1407 · Django+6 · Django+6

Dennis Brinkrolf

·

Published

2022-01-04

·

Updated

2026-01-03

·

CVE-2021-45452

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Django versions 2.2 through 2.2.25 Django versions 3.2 through 3.2.10 Django versions 4.0 through 4.0.0
Description The issue is related to the Storage.save() function in the Django web application framework, which is associated with incorrect restriction of the path name to a limited directory, allowing directory traversal. This can be exploited by a remote attacker to access confidential information by sending a specially crafted HTTP file to the application. The vulnerability can be exploited by passing crafted filenames directly to the Storage.save() function, allowing an attacker to write files outside the intended directory.
Recommendations For Django versions 2.2 through 2.2.25, update to version 2.2.26 or later. For Django versions 3.2 through 3.2.10, update to version 3.2.11 or later. For Django versions 4.0 through 4.0.0, update to version 4.0.1 or later. As a temporary workaround, consider restricting access to the Storage.save() function to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

Related Identifiers

ALT-PU-2022-1075
ALT-PU-2022-1124
BDU:2022-00353
BIT-DJANGO-2021-45452
CVE-2021-45452
DLA-3191-1
GHSA-JRH2-HC4R-7JWX
MGASA-2022-0011
OESA-2022-1530
OESA-2022-2055
OPENSUSE-SU-2023:0005-1
OPENSUSE-SU-2024:11725-1
OPENSUSE-SU-2024:14208-1
OPENSUSE-SU-2025:14662-1
OPENSUSE-SU-2026:10005-1
PYSEC-2022-3
RHSA-2022:5498
RLSA-2022:5498
SUSE-SU-2022:0102-1
SUSE-SU-2022:0103-1
SUSE-SU-2022:0286-1
USN-5204-1

Affected Products

Alt Linux
Astra Linux
Django
Linuxmint
Red Os
Rocky Linux
Ubuntu