CVE-2021-33203: Path Traversal
A flaw was found in django. Staff members could use the :mod:~django.contrib.admindocs TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by the developers to also expose the file contents, then not only the existence but also the file contents would have been exposed. The highest threat from this vulnerability is to data confidentiality.
Other sources
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
Staff members could use the :mod:~django.contrib.admindocs TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by the developers to also expose the file contents, then not only the existence but also the file contents would have been exposed.
As a mitigation, path sanitation is now applied and only files within the template root directories can be loaded.
— Red Hat
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-33203?
CVE-2021-33203 is a vulnerability in Django versions before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 that allows staff members to perform directory traversal and check the existence of arbitrary files.
How severe is CVE-2021-33203?
CVE-2021-33203 has a severity rating of 4.9, which is considered medium.
How can I fix CVE-2021-33203?
To fix CVE-2021-33203, update your Django version to 2.2.24, 3.1.12, or 3.2.4, depending on your current Django version.
Where can I find more information about CVE-2021-33203?
You can find more information about CVE-2021-33203 on the NVD website, Django security releases page, and the Django Announce group.
What is the Common Weakness Enumeration (CWE) for CVE-2021-33203?
The CWE for CVE-2021-33203 is CWE-22.