Django up to 2.2.15/3.0.9/3.1.0 python default permission

Summaryinfo

A vulnerability described as critical has been identified in Django up to 2.2.15/3.0.9/3.1.0. Affected is an unknown function of the component python. Executing a manipulation can lead to default permission. This vulnerability is tracked as CVE-2020-24584. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Django up to 2.2.15/3.0.9/3.1.0 (Content Management System). It has been declared as critical. This vulnerability affects an unknown code block of the component python. The manipulation with an unknown input leads to a default permission vulnerability. The CWE definition for the vulnerability is CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

The weakness was disclosed 09/01/2020. This vulnerability was named CVE-2020-24584 since 08/21/2020. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1222 by the MITRE ATT&CK project.

Upgrading to version 2.2.16, 3.0.10 or 3.1.1 eliminates this vulnerability.

The entry VDB-160521 is pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Name

• Django

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.2.10
• 2.2.11
• 2.2.12
• 2.2.13
• 2.2.14
• 2.2.15
• 3.0
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.1.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion