CVE-2020-24583

Published: Sep 1, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.

Affected (8)

Products: Djangoproject: Django · Canonical: Ubuntu Linux · Fedoraproject: Fedora · +1 more

Show all products

Djangoproject: Django · Canonical: Ubuntu Linux · Fedoraproject: Fedora · Oracle: Zfs Storage Appliance Kit

1 product

1 product

1 product

1 product

Zfs Storage Appliance Kit

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	From 2.2 to 2.2.16
Djangoproject Django	From 3.0 to 3.0.10
Djangoproject Django	From 3.1 to 3.1.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 20.04

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Zfs Storage Appliance Kit	Version 8.8

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (22)

https://docs.djangoproject.com/en/dev/releases/security/

Source: cve@mitre.org

PatchVendor Advisory

https://groups.google.com/forum/#%21topic/django-announce/Gdqn58RqIDM

Source: cve@mitre.org

https://groups.google.com/forum/#%21topic/django-announce/zFCMdgUnutU

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI/

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20200918-0004/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4479-1/

Source: cve@mitre.org

Third Party Advisory

https://www.djangoproject.com/weblog/2020/sep/01/security-releases/

Source: cve@mitre.org

Vendor Advisory

https://www.openwall.com/lists/oss-security/2020/09/01/2

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://docs.djangoproject.com/en/dev/releases/security/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://groups.google.com/forum/#%21topic/django-announce/Gdqn58RqIDM

Source: af854a3a-2127-422b-91ae-364da2661108

https://groups.google.com/forum/#%21topic/django-announce/zFCMdgUnutU

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2ZHO3GZCJMP3DDTXCNVFV6ED3W64NAU/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLGFFLMF3X6USMJD7V5F5P4K2WVUTO3T/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCRPQCBTV3RZHKVZ6K6QOAANPRZQD3GI/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20200918-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4479-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.djangoproject.com/weblog/2020/sep/01/security-releases/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.openwall.com/lists/oss-security/2020/09/01/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.