Lucene search
HistorySep 16, 2013 - 7:14 p.m.
CVE-2013-4315
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
6.5
Confidence
Low
EPSS
0.005
Percentile
77.3%
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a โฆ (dot dot) in a ssi template tag.
Affected configurations
Node
djangoprojectdjangoMatch1.4
ORdjangoprojectdjangoMatch1.4.1
ORdjangoprojectdjangoMatch1.4.2
ORdjangoprojectdjangoMatch1.4.4
ORdjangoprojectdjangoMatch1.4.5
ORdjangoprojectdjangoMatch1.4.6
Node
djangoprojectdjangoMatch1.5
ORdjangoprojectdjangoMatch1.5alpha
ORdjangoprojectdjangoMatch1.5beta
ORdjangoprojectdjangoMatch1.5.1
Node
djangoprojectdjangoMatch1.6beta1
ORdjangoprojectdjangoMatch1.6beta2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| djangoproject | django | 1.4 | cpe:2.3:a:djangoproject:django:1.4:*:*:*:*:*:*:* |
| djangoproject | django | 1.4.1 | cpe:2.3:a:djangoproject:django:1.4.1:*:*:*:*:*:*:* |
| djangoproject | django | 1.4.2 | cpe:2.3:a:djangoproject:django:1.4.2:*:*:*:*:*:*:* |
| djangoproject | django | 1.4.4 | cpe:2.3:a:djangoproject:django:1.4.4:*:*:*:*:*:*:* |
| djangoproject | django | 1.4.5 | cpe:2.3:a:djangoproject:django:1.4.5:*:*:*:*:*:*:* |
| djangoproject | django | 1.4.6 | cpe:2.3:a:djangoproject:django:1.4.6:*:*:*:*:*:*:* |
| djangoproject | django | 1.5 | cpe:2.3:a:djangoproject:django:1.5:*:*:*:*:*:*:* |
| djangoproject | django | 1.5 | cpe:2.3:a:djangoproject:django:1.5:alpha:*:*:*:*:*:* |
| djangoproject | django | 1.5 | cpe:2.3:a:djangoproject:django:1.5:beta:*:*:*:*:*:* |
| djangoproject | django | 1.5.1 | cpe:2.3:a:djangoproject:django:1.5.1:*:*:*:*:*:*:* |
Related
freebsd
freebsd
django -- multiple vulnerabilities
2013-09-10 00:00:00
nessus
nessus
Mandriva Linux Security Advisory : python-django (MDVSA-2013:234)
2013-09-14 00:00:00
FreeBSD : django -- multiple vulnerabilities (a851b305-1bc3-11e3-95b7-00e0814cab4e)
2013-09-13 00:00:00
Debian DSA-2755-1 : python-django - directory traversal
2013-09-12 00:00:00
cvelist
cvelist
CVE-2013-4315
2013-09-16 19:00:00
seebug
seebug
Django "ssi"ๆจกๆฟๆ ็ญพ็ฎๅฝ้ๅๆผๆด(CVE-2013-4315)
2013-09-14 00:00:00
Django ็ฎๅฝ้ๅๅบๅ(CVE-2013-4315)
2013-09-14 00:00:00
prion
prion
Directory traversal
2013-09-16 19:14:00
osv
osv
Django Directory Traversal via ssi template tag
2022-05-17 04:56:46
python-django - directory traversal
2013-09-11 00:00:00
PYSEC-2013-20
2013-09-16 19:14:00
gitlab
gitlab
Directory traversal with ssi template tag
2013-09-16 00:00:00
ubuntucve
ubuntucve
CVE-2013-4315
2013-09-16 00:00:00
veracode
veracode
Directory Traversal
2019-01-15 09:01:36
openvas
openvas
Mageia: Security Advisory (MGASA-2013-0283)
2022-01-28 00:00:00
Debian Security Advisory DSA 2755-1 (python-django - directory traversal)
2013-09-11 00:00:00
Debian: Security Advisory (DSA-2755-1)
2013-09-10 00:00:00
cve
cve
CVE-2013-4315
2013-09-16 19:14:39
debiancve
debiancve
CVE-2013-4315
2013-09-16 19:14:39
debian
debian
[SECURITY] [DSA 2755-1] python-django security update
2013-09-11 14:24:55
[SECURITY] [DSA 2755-1] python-django security update
2013-09-11 14:24:55
github
github
Django Directory Traversal via ssi template tag
2022-05-17 04:56:46
mageia
mageia
Updated python-django package fixes security vulnerability
2013-09-19 13:41:40
Updated python-django package fixes multiple vulnerabilities
2013-09-19 13:45:04
fedora
fedora
[SECURITY] Fedora 19 Update: python-django-1.5.4-1.fc19
2013-09-24 22:56:43
[SECURITY] Fedora 19 Update: python-django14-1.4.8-1.fc19
2013-09-24 23:05:13
[SECURITY] Fedora 20 Update: python-django14-1.4.8-1.fc20
2013-09-24 23:00:28
securityvulns
securityvulns
[USN-1967-1] Django vulnerabilities
2013-10-02 00:00:00
ubuntu
ubuntu
Django vulnerabilities
2013-09-24 00:00:00
redhat
redhat
(RHSA-2013:1521) Moderate: python-django security update
2013-11-14 00:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
6.5
Confidence
Low
EPSS
0.005
Percentile
77.3%
Related for NVD:CVE-2013-4315