CVE-2022-24840

CVE-2022-24840 concerns django-s3file, a Django/Amazon S3 file-upload helper. The vulnerability (in versions prior to 5.5.1) allows path traversal of the S3 bucket via the s3file middleware, enabling access or deletion of files in many cases. Root cause: insufficient input validation in the middl...

CVE-2022-24840

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the "AWSLOCATION" setting was set, traversal was limited to that location only. The issue was...

CVE-2022-24840 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the AWSLOCATION setting was set, traversal was limited to that location only. The issue was...

PT-2022-16914

Name of the Vulnerable Software and Affected Versions django-s3file versions prior to 5.5.1 Description The issue allows an attacker to traverse the entire AWS S3 bucket and in most cases access or delete files. If the AWS LOCATION setting was set, traversal was limited to that location only. The...

CVE-2022-24840: Improper Limitation of a Pathname to a Restricted Directory

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the AWSLOCATION setting was set, traversal was limited to that location only. The issue was...