CVE-2011-0698: Path Traversal
Published Feb 14, 2011
·Updated
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
Affected Software
23 affected componentsFixes available
pip/Django>=1.2<1.2.5
1.2.5
pip/Django>=1.1<1.1.4
1.1.4
All of the following
Any of the following
djangoproject Django=1.1
djangoproject Django=1.1.0
djangoproject Django=1.1.2
djangoproject Django=1.1.3
Microsoft Windows
All of the following
Any of the following
djangoproject Django=1.2
djangoproject Django=1.2.1
djangoproject Django=1.2.2
djangoproject Django=1.2.3
djangoproject Django=1.2.4
Microsoft Windows
djangoproject Django=1.1
djangoproject Django=1.1.0
djangoproject Django=1.1.2
djangoproject Django=1.1.3
Microsoft Windows
djangoproject Django=1.2
djangoproject Django=1.2.1
djangoproject Django=1.2.2
djangoproject Django=1.2.3
djangoproject Django=1.2.4
Remediation
Patch Available
Patch Available
Event History
Feb 14, 2011
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
09:00 PM
DescriptionWeaknessAffected Software
Jul 23, 2018
Advisory Published
via GitHub·07:52 PM
Frequently Asked Questions
1
What is the severity of CVE-2011-0698?
CVE-2011-0698 is rated as a medium severity vulnerability due to its potential to allow unauthorized file access.
2
How do I fix CVE-2011-0698?
To fix CVE-2011-0698, upgrade to Django version 1.1.4 or 1.2.5 or later.
3
What software is affected by CVE-2011-0698?
CVE-2011-0698 affects Django versions 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows.
4
Can I be attacked through CVE-2011-0698 if I am using Django 1.2.5?
No, if you are using Django 1.2.5 or later, you are not vulnerable to CVE-2011-0698.
5
What types of attacks are possible with CVE-2011-0698?
CVE-2011-0698 could allow remote attackers to read or execute files by exploiting a directory traversal vulnerability.