Lucene search

[email protected]NVD:CVE-2021-45452

HistoryJan 05, 2022 - 12:15 a.m.

CVE-2021-45452

2022-01-0500:15:07

CWE-22

[email protected]

web.nvd.nist.gov

django

storage.save

directory traversal

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

58.2%

JSON

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

Affected configurations

Nvd

Node

djangoprojectdjangoRange2.2–2.2.26

djangoprojectdjangoRange3.2–3.2.11

djangoprojectdjangoRange4.0–4.0.1

Node

fedoraprojectfedoraMatch35

VendorProductVersionCPE
djangoprojectdjango*cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*