Lucene search
GoogleOSV:PYSEC-2021-9HistoryFeb 02, 2021 - 7:15 a.m.
PYSEC-2021-9
2021-02-0207:15:00
Google
osv.dev
35
0.001 Low
EPSS
Percentile
51.1%
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by “startapp --template” and “startproject --template”) allows directory traversal via an archive with absolute paths or relative paths with dot segments.
References
docs.djangoproject.com/en/3.1/releases/security/
github.com/advisories/GHSA-fvgf-6h6h-3322
groups.google.com/forum/#!forum/django-announce
lists.fedoraproject.org/archives/list/[email protected]/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
security.netapp.com/advisory/ntap-20210226-0004/
www.djangoproject.com/weblog/2021/feb/01/security-releases/
Related
redhatcve
redhatcve
CVE-2021-3281
2021-02-01 18:27:55
osv
osv
BIT-django-2021-3281
2024-03-06 10:54:53
python-django vulnerability
2021-02-01 11:55:47
CVE-2021-3281
2021-02-02 07:15:14
openvas
openvas
Django 2.2 < 2.2.18, 3.0 < 3.0.12, 3.1 < 3.1.6 Directory Traversal Vulnerability - Windows
2021-02-03 00:00:00
Debian: Security Advisory (DLA-2540-1)
2021-02-02 00:00:00
Ubuntu: Security Advisory (USN-4715-2)
2022-08-26 00:00:00
fedora
fedora
[SECURITY] Fedora 33 Update: python-django-3.0.12-1.fc33
2021-02-13 01:40:25
[SECURITY] Fedora 32 Update: python-django-3.0.13-1.fc32
2021-03-13 20:53:46
ubuntu
ubuntu
Django vulnerability
2021-02-01 00:00:00
Django vulnerability
2021-02-01 00:00:00
prion
prion
Directory traversal
2021-02-02 07:15:00
cve
cve
CVE-2021-3281
2021-02-02 07:15:14
nessus
nessus
Debian DLA-2540-1 : python-django security update
2021-02-02 00:00:00
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Django vulnerability (USN-4715-1)
2021-02-01 00:00:00
Fedora 33 : python-django (2021-5329c680f7)
2021-02-16 00:00:00
debian
debian
[SECURITY] [DLA 2540-1] python-django security update
2021-02-01 18:37:39
[SECURITY] [DLA 3164-1] python-django security update
2022-10-28 17:28:30
githubexploit
githubexploit
Exploit for Path Traversal in Djangoproject Django
2021-07-05 08:25:26
alpinelinux
alpinelinux
CVE-2021-3281
2021-02-02 07:15:14
cvelist
cvelist
CVE-2021-3281
2021-02-02 06:16:28
archlinux
archlinux
[ASA-202102-18] python-django: directory traversal
2021-02-07 00:00:00
veracode
veracode
Arbitrary File Write
2021-02-02 01:38:27
ubuntucve
ubuntucve
CVE-2021-3281
2021-02-01 00:00:00
github
github
Django Directory Traversal via archive.extract
2021-03-18 20:29:49
debiancve
debiancve
CVE-2021-3281
2021-02-02 07:15:14
nvd
nvd
CVE-2021-3281
2021-02-02 07:15:14
altlinux
altlinux
redhat
redhat