Log in Start free

Vulnerability · Published Jun 8, 2021 · Assigned by mitre

CVE-2021-33203

Medium 4.9

In plain English

A medium-severity security flaw in the py3-django package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.9Medium
Exploit odds (30 days)2.7%top 13.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20py3-django3.1.13-r0ALPINE-CVE-2021-33203
Alpine:v3.21py3-django3.1.13-r0ALPINE-CVE-2021-33203
Alpine:v3.22py3-django3.1.13-r0ALPINE-CVE-2021-33203
Alpine:v3.23py3-django3.1.13-r0ALPINE-CVE-2021-33203
Alpine:v3.24py3-django3.1.13-r0ALPINE-CVE-2021-33203
Debian:12python-django2:2.2.24-1DEBIAN-CVE-2021-33203
Debian:13python-django2:2.2.24-1DEBIAN-CVE-2021-33203
Debian:14python-django2:2.2.24-1DEBIAN-CVE-2021-33203
PyPIdjango2.2.24, 3.1.12, 3.2.4PYSEC-2021-98
PyPIdjango3.2.4GHSA-68w8-qjq3-2gfm
PyPIdjango3.1.12GHSA-68w8-qjq3-2gfm
PyPIdjango2.2.24GHSA-68w8-qjq3-2gfm

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References