CVE-2021-33203: Path Traversal
First published: Mon May 31 2021(Updated: )
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/python-django20 | <0:2.0.13-16.el8 | 0:2.0.13-16.el8 |
| redhat/python3-django | <0:2.2.24-1.el7 | 0:2.2.24-1.el7 |
| Djangoproject Django | <2.2.24 | |
| Djangoproject Django | >=3.0.0<3.1.12 | |
| Djangoproject Django | >=3.2.0<3.2.4 | |
| Fedoraproject Fedora | =35 | |
| pip/django | >=3.2.0<3.2.4 | 3.2.4 |
| pip/django | >=3.0.0<3.1.12 | 3.1.12 |
| pip/django | <2.2.24 | 2.2.24 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2021-33203
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://www.djangoproject.com/weblog/2021/jun/02/security-releases/
- https://security.netapp.com/advisory/ntap-20210727-0004/
- https://github.com/django/django/commit/053cc9534d174dc89daba36724ed2dcb36755b90
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://github.com/django/django/commit/20c67a0693c4ede2b09af02574823485e82e4c8f
- https://github.com/django/django/commit/dfaba12cda060b8b292ae1d271b44bf810b1c5b9
- https://github.com/advisories/GHSA-68w8-qjq3-2gfm (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1967409
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1967411
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1967410
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1967412
- https://www.djangoproject.com/download/#supported-versions
- https://access.redhat.com/errata/RHSA-2021:3490
- https://access.redhat.com/security/cve/cve-2021-33203
- https://access.redhat.com/errata/RHSA-2021:4702
- https://access.redhat.com/errata/RHSA-2021:5070
- https://bugzilla.redhat.com/show_bug.cgi?id=1966251
- https://www.cve.org/CVERecord?id=CVE-2021-33203 https://nvd.nist.gov/vuln/detail/CVE-2021-33203 https://www.djangoproject.com/weblog/2021/jun/02/security-releases/
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-33203?
CVE-2021-33203 is a vulnerability in Django versions before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 that allows staff members to perform directory traversal and check the existence of arbitrary files.
How severe is CVE-2021-33203?
CVE-2021-33203 has a severity rating of 4.9, which is considered medium.
How can I fix CVE-2021-33203?
To fix CVE-2021-33203, update your Django version to 2.2.24, 3.1.12, or 3.2.4, depending on your current Django version.
Where can I find more information about CVE-2021-33203?
You can find more information about CVE-2021-33203 on the NVD website, Django security releases page, and the Django Announce group.
What is the Common Weakness Enumeration (CWE) for CVE-2021-33203?
The CWE for CVE-2021-33203 is CWE-22.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- alias/GHSA-68w8-qjq3-2gfm
- alias/CVE-2021-33203
- collector/github-advisory-latest
- collector/nvd-cve
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/redhat-cve
- package-manager/pip
- vendor/djangoproject
- canonical/djangoproject django
- version/djangoproject django/3.0.0
- version/djangoproject django/3.2.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- package-manager/redhat