CVE-2021-31542

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Link	Resource
https://www.djangoproject.com/weblog/2021/may/04/security-releases/	Release Notes Vendor Advisory
https://docs.djangoproject.com/en/3.2/releases/security/	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/05/04/3	Mailing List Patch
https://groups.google.com/forum/#!forum/django-announce	Release Notes Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00005.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20210618-0001/	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

---

Published : 2021-05-05 03:15

Updated : 2022-06-28 02:11

---

NVD link : CVE-2021-31542

Mitre link : CVE-2021-31542

No products.

CWE-22