GoogleOSV:GHSA-FR28-569J-53C4Django Incorrect Default Permissions
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
54.3%
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system’s standard umask rather than 0o077.
References
docs.djangoproject.com/en/dev/releases/security
github.com/django/django
github.com/django/django/commit/1853724acaf17ed7414d54c7d2b5563a25025a71
github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e81915b
github.com/django/django/commit/a3aebfdc8153dc230686b6d2454ccd32ed4c9e6f
github.com/django/django/commit/cdb367c92a0ba72ddc0cbd13ff42b0e6df709554
groups.google.com/forum/#!topic/django-announce/Gdqn58RqIDM
groups.google.com/forum/#!topic/django-announce/zFCMdgUnutU
lists.fedoraproject.org/archives/list/[email protected]/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU
lists.fedoraproject.org/archives/list/[email protected]/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T
lists.fedoraproject.org/archives/list/[email protected]/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI
nvd.nist.gov/vuln/detail/CVE-2020-24584
security.netapp.com/advisory/ntap-20200918-0004
usn.ubuntu.com/4479-1
www.djangoproject.com/weblog/2020/sep/01/security-releases
www.openwall.com/lists/oss-security/2020/09/01/2
www.oracle.com/security-alerts/cpujan2021.html
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
54.3%