CVE-2009-2659

2009-08-0416:30:00

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

79.1%

JSON

The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected “static media files,” which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.

OSVersionArchitecturePackageVersionFilename
Debian12allpython-django< 1.1-1python-django_1.1-1_all.deb
Debian11allpython-django< 1.1-1python-django_1.1-1_all.deb
Debian999allpython-django< 1.1-1python-django_1.1-1_all.deb
Debian13allpython-django< 1.1-1python-django_1.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	python-django	< 1.1-1	python-django_1.1-1_all.deb
Debian	11	all	python-django	< 1.1-1	python-django_1.1-1_all.deb
Debian	999	all	python-django	< 1.1-1	python-django_1.1-1_all.deb
Debian	13	all	python-django	< 1.1-1	python-django_1.1-1_all.deb