Description

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Remediation

References

CVE-2021-31542

Related Vulnerabilities

PHP Improper Restriction of XML External Entity Reference Vulnerability (CVE-2023-3823)

WordPress Plugin Contact Form by WD-responsive drag & drop contact form builder tool Multiple Vulnerabilities (1.12.20)

Oracle Application Server Other Vulnerability (CVE-2005-3449)

WordPress Plugin VideoWhisper Video Presentation Multiple Cross-Site Scripting Vulnerabilities (3.25)

WordPress Plugin Share Buttons by AddThis Cross-Site Scripting (4.0.7)

Severity

High

Classification

CVE-2021-31542 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities