CVE-2009-2659: Path Traversal
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
Other sources
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2659?
CVE-2009-2659 is considered to be a critical vulnerability due to its potential for remote exploitation through directory traversal attacks.
How do I fix CVE-2009-2659?
To fix CVE-2009-2659, upgrade Django to version 1.0.3 or 0.96.4 as appropriate.
What versions of Django are affected by CVE-2009-2659?
CVE-2009-2659 affects Django versions 1.0 and 0.96, prior to their patched releases.
What are the consequences of exploiting CVE-2009-2659?
Exploiting CVE-2009-2659 could allow attackers to read arbitrary files from the server, leading to data exposure.
Is CVE-2009-2659 still a risk for current Django applications?
CVE-2009-2659 poses a risk only for applications still running unpatched versions of Django 1.0 or 0.96.