Lucene search

K

Veracode Vulnerability DatabaseVERACODE:48032

HistoryJul 11, 2024 - 6:51 a.m.

Path Traversal

2024-07-1106:51:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5

django

path traversal

storage

AI Score

6.5

Confidence

Low

Django is vulnerable to Path Traversal. The vulnerability is due to derived classes of the django.core.files.storage.Storage base class that override generate_filename() without replicating the file-path validations from the parent class, potentially allowing path traversal via certain inputs during a save() call.

References

docs.djangoproject.com/en/dev/releases/security/

github.com/django/django/commit/2b00edc0151a660d1eb86da4059904a0fc4e095e

github.com/django/django/commit/9f4f63e9ebb7bf6cb9547ee4e2526b9b96703270

groups.google.com/forum/#%21forum/django-announce

www.djangoproject.com/weblog/2024/jul/09/security-releases/

AI Score

6.5

Confidence

Low

Related for VERACODE:48032

debiancve1 osv5 nvd1 vulnrichment1 cve1 cvelist1 ubuntucve1 github1 redhatcve1 wolfi1 freebsd1 openvas8 ubuntu2 nessus6 fedora4 ibm1 redhat1