CVE-2013-4315: Path Traversal
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWEDINCLUDEROOTS setting followed by a .. (dot dot) in a ssi template tag.
Other sources
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWEDINCLUDEROOTS setting followed by a .. (dot dot) in a ssi template tag.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4315?
CVE-2013-4315 has been classified as a medium severity vulnerability due to its potential impact on the application security by allowing unauthorized file access.
How do I fix CVE-2013-4315?
To fix CVE-2013-4315, upgrade to Django version 1.4.7, 1.5.3, or any later version.
Which versions of Django are affected by CVE-2013-4315?
CVE-2013-4315 affects Django versions 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3.
What type of vulnerability is CVE-2013-4315?
CVE-2013-4315 is a directory traversal vulnerability that allows remote attackers to read arbitrary files.
What should I do if I can't upgrade Django to fix CVE-2013-4315?
If you cannot upgrade Django, validate the ALLOWED_INCLUDE_ROOTS configuration and restrict access to sensitive files as a temporary mitigation against CVE-2013-4315.