Path traversal in Django - CVE-2021-33203

Vulnerability identifier: #VU53741

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33203

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the "admindocs" view. A remote authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Django
Arch Linux
Gentoo Linux
Ubuntu
Fedora
python-django (Ubuntu package)
python3-django (Ubuntu package)
python-django20 (Red Hat package)
python-django
dev-python/django
Red Hat OpenStack

Install update from vendor's website.

Django - addressed in versions 2.2.24, 3.1.12, 3.2.4
python-django (Ubuntu package) - addressed in versions 1.8.71ubuntu5.15+esm3, 1:1.11.11-1ubuntu1.14
python3-django (Ubuntu package) - addressed in versions 1.8.71ubuntu5.15+esm3, 1:1.11.11-1ubuntu1.14, 2:2.2.12-1ubuntu0.7, 2:2.2.16-1ubuntu0.5, 2:2.2.20-1ubuntu0.2
python-django20 (Red Hat package) - update to 2.0.13-16.el8ost.1
python-django - addressed in versions 3.2.12-1.fc35, 4.0.2-1.fc36
dev-python/django - update to 5.2.1
Red Hat OpenStack - addressed in versions 16.1, 16.2

• https://www.djangoproject.com/weblog/2021/jun/02/security-releases/

• Multiple vulnerabilities in Django
• Arch Linux update for python-django
• Ubuntu update for python-django
• Ubuntu update for python-django
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Red Hat OpenStack 16.1 packages
• Fedora 36 update for python-django
• Fedora 35 update for python-django
• Gentoo update for Django