Published: 01/09/2020 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

An issue exists in Django 2.2 prior to 2.2.16, 3.0 prior to 3.0.10, and 3.1 prior to 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

Vulnerable Product	Search on Vulmon	Subscribe to Product
djangoproject django
canonical ubuntu linux 20.04
fedoraproject fedora 31
fedoraproject fedora 32
fedoraproject fedora 33
oracle zfs storage appliance kit 8.8

Debian Bug report logs - #969367 python-django: CVE-2020-24583 CVE-2020-24584 Package: python-django; Maintainer for python-django is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Source for python-django is src:python-django (PTS, buildd, popcon) Reported by: "Chris Lamb" <lamby@debianorg> ...

An issue was discovered in Django 22 before 2216, 30 before 3010, and 31 before 311 (when Python 37+ is used) The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077 ...

CWE-276 https://www.openwall.com/lists/oss-security/2020/09/01/2 https://www.djangoproject.com/weblog/2020/sep/01/security-releases/https://docs.djangoproject.com/en/dev/releases/security/https://usn.ubuntu.com/4479-1/https://security.netapp.com/advisory/ntap-20200918-0004/https://www.oracle.com/security-alerts/cpujan2021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T/https://groups.google.com/forum/#%21topic/django-announce/zFCMdgUnutU https://groups.google.com/forum/#%21topic/django-announce/Gdqn58RqIDM https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969367 https://nvd.nist.gov https://security.archlinux.org/CVE-2020-24584

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-24584

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect