Lucene search
HistoryAug 26, 2014 - 2:55 p.m.
CVE-2014-0481
django
file upload
denial of service
cve-2014-0481
nvd
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
6.3 Medium
AI Score
Confidence
Low
0.023 Low
EPSS
Percentile
89.8%
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.
Affected configurations
Node
opensuseopensuseMatch13.1
ORopensuse_projectopensuseMatch12.3
Node
djangoprojectdjangoRange≤1.4.13
ORdjangoprojectdjangoMatch1.4
ORdjangoprojectdjangoMatch1.4.1
ORdjangoprojectdjangoMatch1.4.2
ORdjangoprojectdjangoMatch1.4.4
ORdjangoprojectdjangoMatch1.4.5
ORdjangoprojectdjangoMatch1.4.6
ORdjangoprojectdjangoMatch1.4.7
ORdjangoprojectdjangoMatch1.4.8
ORdjangoprojectdjangoMatch1.4.9
ORdjangoprojectdjangoMatch1.4.10
ORdjangoprojectdjangoMatch1.4.11
ORdjangoprojectdjangoMatch1.4.12
Node
djangoprojectdjangoMatch1.5
ORdjangoprojectdjangoMatch1.5alpha
ORdjangoprojectdjangoMatch1.5beta
ORdjangoprojectdjangoMatch1.5.1
ORdjangoprojectdjangoMatch1.5.2
ORdjangoprojectdjangoMatch1.5.3
ORdjangoprojectdjangoMatch1.5.4
ORdjangoprojectdjangoMatch1.5.5
ORdjangoprojectdjangoMatch1.5.6
ORdjangoprojectdjangoMatch1.5.7
ORdjangoprojectdjangoMatch1.5.8
Node
djangoprojectdjangoMatch1.7beta1
ORdjangoprojectdjangoMatch1.7beta2
ORdjangoprojectdjangoMatch1.7beta3
ORdjangoprojectdjangoMatch1.7beta4
ORdjangoprojectdjangoMatch1.7rc1
ORdjangoprojectdjangoMatch1.7rc2
Node
djangoprojectdjangoMatch1.6-
ORdjangoprojectdjangoMatch1.6beta1
ORdjangoprojectdjangoMatch1.6beta2
ORdjangoprojectdjangoMatch1.6beta3
ORdjangoprojectdjangoMatch1.6beta4
ORdjangoprojectdjangoMatch1.6.1
ORdjangoprojectdjangoMatch1.6.2
ORdjangoprojectdjangoMatch1.6.3
ORdjangoprojectdjangoMatch1.6.4
ORdjangoprojectdjangoMatch1.6.5
Node
debiandebian_linuxMatch7.0
| CPE | Name | Operator | Version |
|---|---|---|---|
| opensuse:opensuse | opensuse | eq | 13.1 |
| opensuse_project:opensuse | opensuse project opensuse | eq | 12.3 |
Related
ubuntucve
ubuntucve
CVE-2014-0481
2014-08-26 00:00:00
github
github
Django denial of service via file upload naming
2022-05-14 02:05:08
osv
osv
PYSEC-2014-5
2014-08-26 14:55:00
Django denial of service via file upload naming
2022-05-14 02:05:08
python-django - security update
2014-08-22 00:00:00
nvd
nvd
CVE-2014-0481
2014-08-26 14:55:05
prion
prion
Default configuration
2014-08-26 14:55:00
debiancve
debiancve
CVE-2014-0481
2014-08-26 14:55:05
cvelist
cvelist
CVE-2014-0481
2014-08-26 14:00:00
freebsd
freebsd
django -- multiple vulnerabilities
2014-08-20 00:00:00
nessus
nessus
Fedora 20 : python-django14-1.4.16-1.fc20 (2014-15266)
2014-12-02 00:00:00
Mandriva Linux Security Advisory : python-django (MDVSA-2014:179)
2014-09-12 00:00:00
GLSA-201412-22 : Django: Multiple vulnerabilities
2014-12-15 00:00:00
gentoo
gentoo
Django: Multiple vulnerabilities
2014-12-13 00:00:00
mageia
mageia
Updated python-django packages fix multiple vulnerabilities
2014-09-05 13:07:37
fedora
fedora
[SECURITY] Fedora 20 Update: python-django15-1.5.9-1.fc20
2014-09-10 13:29:30
[SECURITY] Fedora 20 Update: python-django14-1.4.16-1.fc20
2014-12-01 18:59:44
[SECURITY] Fedora 20 Update: python-django14-1.4.14-1.fc20
2014-09-09 22:27:18
ubuntu
ubuntu
Django vulnerabilities
2014-09-16 00:00:00
openvas
openvas
Gentoo Security Advisory GLSA 201412-22
2015-09-29 00:00:00
Ubuntu: Security Advisory (USN-2347-1)
2014-09-17 00:00:00
Debian Security Advisory DSA 3010-1 (python-django - security update)
2014-08-22 00:00:00
debian
debian
[SECURITY] [DSA 3010-1] python-django security update
2014-08-22 20:52:59
[SECURITY] [DLA 65-1] python-django security update
2014-09-29 08:20:58
[SECURITY] [DSA 3010-1] python-django security update
2014-08-22 20:52:59
securityvulns
securityvulns
[SECURITY] [DSA 3010-1] python-django security update
2014-08-26 00:00:00
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
6.3 Medium
AI Score
Confidence
Low
0.023 Low
EPSS
Percentile
89.8%
Related for CVE-2014-0481