{"id":"CVE-2020-24583","published":"2020-09-01T12:33:13Z","modified":"2024-08-04T15:19:08Z","title":"An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used)","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03969,"percentile":0.90434,"provenance":"source"},"cwes":[],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["x_refsource_MISC"]},{"url":"https://usn.ubuntu.com/4479-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/forum/#%21topic/django-announce/zFCMdgUnutU","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/forum/#%21topic/django-announce/Gdqn58RqIDM","tags":["x_refsource_MISC"]},{"url":"https://www.openwall.com/lists/oss-security/2020/09/01/2","tags":["x_refsource_MISC"]},{"url":"https://www.djangoproject.com/weblog/2020/sep/01/security-releases/","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200918-0004/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.1,"factors":[{"name":"EPSS percentile","points":18.09}]},"affected":[{"ecosystem":"PyPI","package":"Django","vulnerableRanges":[">=2.2a1, <2.2.16",">=3.0a1, <3.0.10",">=3.1a1, <3.1.1",">=2.2, <2.2.16",">=3.0, <3.0.10",">=3.1, <3.1.1"],"patched":["2.2.16","3.0.10","3.1.1"],"from":["GHSA-m6gj-h9gm-gw44","PYSEC-2020-33"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0069","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2018-7537","children":[{"from":"CVE-2020-24583","to":"CVE-2021-31542","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["django/core/files/storage.py"],"commits":["https://github.com/django/django/commit/8d7271578d7b153435b40fe40236ebec43cbf1b9","https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d","https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-9402","published":"2020-03-05","fixed":"3.0.4","kev":false},{"cve":"CVE-2020-13254","published":"2020-06-03","fixed":"3.0.7","kev":false,"link":{"from":"CVE-2020-13254","to":"CVE-2020-24583","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"2.2.13","toFixed":"2.2.16","daysApart":90},{"kind":"version-step","provenance":"source","package":"PyPI:Django","fromFixed":"3.0.7","toFixed":"3.0.10","daysApart":90}]}},{"cve":"CVE-2020-13596","published":"2020-06-03","fixed":"3.0.7","kev":false},{"cve":"CVE-2020-24583","published":"2020-09-01","fixed":"3.1.1","kev":false},{"cve":"CVE-2020-24584","published":"2020-09-01","fixed":"3.1.1","kev":false},{"cve":"CVE-2021-3281","published":"2021-02-02","fixed":"3.1.6","kev":false},{"cve":"CVE-2021-28658","published":"2021-04-06","fixed":"3.1.8","kev":false}],"package":"PyPI:Django"}}