CVE-2020-24583MEDIUM
Description
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.
References
https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/forum/#!topic/django-announce/Gdqn58RqIDM
https://groups.google.com/forum/#!topic/django-announce/zFCMdgUnutU
https://security.netapp.com/advisory/ntap-20200918-0004/
https://usn.ubuntu.com/4479-1/
https://www.djangoproject.com/weblog/2020/sep/01/security-releases/
Details
Source: MITRE
Published: 2020-09-01
Updated: 2021-01-20
Type: CWE-276
Risk Information
CVSS v2.0
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3.0
Base Score: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 3.9
Severity: HIGH
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
Configuration 2
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 140551 | Fedora 32 : python-django (2020-94407454d7) | Nessus | Fedora Local Security Checks | medium |
| 140549 | Fedora 31 : python-django (2020-6941c0a65b) | Nessus | Fedora Local Security Checks | medium |
| 140310 | FreeBSD : Django -- multiple vulnerabilities (002432c8-ef6a-11ea-ba8f-08002728f74c) | Nessus | FreeBSD Local Security Checks | medium |
| 140177 | Ubuntu 20.04 : Django vulnerabilities (USN-4479-1) | Nessus | Ubuntu Local Security Checks | medium |