Arbitrary file upload in Django - CVE-2021-31542
Published: May 4, 2021
Vulnerability identifier: #VU52842
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2021-31542
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Django Software Foundation
Affected software:
Django
Django
Detailed vulnerability description
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload via the MultiPartParser, UploadedFile, and FieldFile methods. A remote attacker can upload a file with a specially crafted filename containing directory traversal characters and overwrite arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
How to mitigate CVE-2021-31542
Install updates from vendor's website.