Published: 02/02/2021 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

In Django 2.2 prior to 2.2.18, 3.0 prior to 3.0.12, and 3.1 prior to 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

Vulnerable Product	Search on Vulmon	Subscribe to Product
djangoproject django
fedoraproject fedora 33
netapp snapcenter -

Debian Bug report logs - #981562 python-django: CVE-2021-3281 Package: python-django; Maintainer for python-django is Debian Python Team <team+python@trackerdebianorg>; Source for python-django is src:python-django (PTS, buildd, popcon) Reported by: "Chris Lamb" <lamby@debianorg> Date: Mon, 1 Feb 2021 11:57:02 UT ...

The djangoutilsarchiveextract() function, used by startapp --template and startproject --template, allowed directory-traversal via an archive with absolute paths or relative paths with dot segments ...

CVE-2021-3281 There is a Directory Traversal vulnerability in djangoutilsarchivepy, lineno:171, in Class TarArchive The function call ospathjoin(to_path, name) didn't check the param "name",if someone use this util on windows platform,there'll be a Directory Traversal risk, the POC is: from djangoutils import archive archiveextract('testtar

CWE-22 https://docs.djangoproject.com/en/3.1/releases/security/https://www.djangoproject.com/weblog/2021/feb/01/security-releases/https://security.netapp.com/advisory/ntap-20210226-0004/https://groups.google.com/forum/#%21forum/django-announce https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981562 https://nvd.nist.gov https://security.archlinux.org/CVE-2021-3281

CVE-2021-3281

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect