7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
54.5%
Severity: Medium
Date : 2020-09-03
CVE-ID : CVE-2020-24583 CVE-2020-24584
Package : python-django
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1217
The package python-django before version 3.1.1-1 is vulnerable to
multiple issues including access restriction bypass and insufficient
validation.
Upgrade to 3.1.1-1.
The problems have been fixed upstream in version 3.1.1.
None.
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10,
and 3.1 before 3.1.1 (when Python 3.7+ is used).
FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-
level directories created in the process of uploading files. It was
also not applied to intermediate-level collected static directories
when using the collectstatic management command.
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10,
and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level
directories of the filesystem cache had the system’s standard umask
rather than 0o077.
A remote attacker is able to upload and overwrite files.
https://bugs.archlinux.org/task/67794
https://www.djangoproject.com/weblog/2020/sep/01/security-releases/
https://github.com/django/django/commit/934430d22aa5d90c2ba33495ff69a6a1d997d584
https://github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e81915b
https://security.archlinux.org/CVE-2020-24583
https://security.archlinux.org/CVE-2020-24584
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | python-django | < 3.1.1-1 | UNKNOWN |
bugs.archlinux.org/task/67794
github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e81915b
github.com/django/django/commit/934430d22aa5d90c2ba33495ff69a6a1d997d584
security.archlinux.org/AVG-1217
security.archlinux.org/CVE-2020-24583
security.archlinux.org/CVE-2020-24584
www.djangoproject.com/weblog/2020/sep/01/security-releases/
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
54.5%