CVE-2021-31542
python-django - security update
7.5
HIGH
CVSS 3.1
EPSS 5.3%
Description
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
How to fix CVE-2021-31542
To remediate CVE-2021-31542, upgrade the affected package to a fixed version below.
- Bitnami/django—upgrade to 2.2.21 or later
- —upgrade to 2:2.2.21-1 or later
- —upgrade to 1:1.10.7-2+deb9u13 or later
- —upgrade to 2.2.21 or later
- —upgrade to 2.2.21 or later
Is CVE-2021-31542 being exploited?
Moderate — EPSS is 5.3%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (5)
- >= 2.2.0, < 2.2.21, >= 3.1.0, < 3.1.9, >= 3.2.0, < 3.2.1
- from 0, < 2:2.2.21-1
- from 0, < 1:1.10.7-2+deb9u13
- >= 2.2, < 2.2.21
- >= 2.2, < 2.2.21, >= 3.1, < 3.1.9, >= 3.2, < 3.2.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |