{"id":"CVE-2013-4315","published":"2013-09-16T19:00:00Z","modified":"2024-08-06T16:38:01Z","title":"Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows…","vendor":null,"product":null,"tier":"tail","description":{"text":"Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03208,"percentile":0.88118,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/54772","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1521.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/54828","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.debian.org/security/2013/dsa-2755","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":17.6,"factors":[{"name":"EPSS percentile","points":17.62}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=1.4, <1.4.7",">=1.5, <1.5.3"],"patched":["1.4.7","1.5.3"],"from":["GHSA-vjjp-9r83-22rc","PYSEC-2013-20"],"provenance":"source"}],"euvd":{"id":"EUVD-2013-0008","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2010-3082","parents":[{"from":"CVE-2010-3082","to":"CVE-2013-4315","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/template/defaulttags.py"],"commits":["https://github.com/django/django/commit/7f84657b6b2243cc787bdb9f296710c8d13ad0bd","https://github.com/django/django/commit/87d2750b39f6f2d54b7047225521a44dcd37e896","https://github.com/django/django/commit/988b61c550d798f9a66d17ee0511fb7a9a7f33ca"],"basis":"shared function","functions":["render"]}]}],"packageHistory":[{"cve":"CVE-2013-1664","published":"2013-04-03","fixed":"1.4.4","kev":false},{"cve":"CVE-2013-1665","published":"2013-04-03","fixed":"1.4.4","kev":false},{"cve":"CVE-2013-6044","published":"2013-10-04","fixed":"1.5.2","kev":false},{"cve":"CVE-2013-4315","published":"2013-09-16","fixed":"1.5.3","kev":false},{"cve":"CVE-2013-1443","published":"2013-09-23","fixed":"1.5.4","kev":false,"link":{"from":"CVE-2013-4315","to":"CVE-2013-1443","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"1.4.7","toFixed":"1.4.8","daysApart":7}]}},{"cve":"CVE-2014-0472","published":"2014-04-23","fixed":"1.6.3","kev":false},{"cve":"CVE-2014-0473","published":"2014-04-23","fixed":"1.6.3","kev":false}],"package":"PyPI:Django"}}