#VU52842 Arbitrary file upload in Django - CVE-2021-31542
Published: May 4, 2021
Vulnerability identifier: #VU52842
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2021-31542
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Django
Django
Software vendor:
Django Software Foundation
Django Software Foundation
Description
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload via the MultiPartParser, UploadedFile, and FieldFile methods. A remote attacker can upload a file with a specially crafted filename containing directory traversal characters and overwrite arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
Remediation
Install updates from vendor's website.