search

sultanabubaker / PIP_test

0 stars 0 forks source link

CVE-2021-31542 (High) detected in Django-3.2-py3-none-any.whl - autoclosed #8

Closed dev-mend-for-github-com[bot] closed 2 years ago

dev-mend-for-github-com[bot] commented 2 years ago

CVE-2021-31542 - High Severity Vulnerability

Vulnerable Library - Django-3.2-py3-none-any.whl

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/a8/9b/fe94c509e514f6c227308e81076506eb9d67f2bfb8061ce5cdfbde0432e3/Django-3.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **Django-3.2-py3-none-any.whl** (Vulnerable Library)

Found in HEAD commit: a0f0fea5b687ba84ade5b5c5d1469021d26ae17d

Found in base branch: main

Vulnerability Details

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Publish Date: 2021-05-05

URL: CVE-2021-31542

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.djangoproject.com/weblog/2021/may/04/security-releases/

Release Date: 2021-05-05

Fix Resolution: Django - 2.2.21,3.1.9,3.2.1

:rescue_worker_helmet: Automatic Remediation is available for this issue

dev-mend-for-github-com[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

dev-mend-for-github-com[bot] commented 2 years ago

:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.

dev-mend-for-github-com[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

dev-mend-for-github-com[bot] commented 2 years ago

:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.

dev-mend-for-github-com[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

dev-mend-for-github-com[bot] commented 2 years ago

:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.

dev-mend-for-github-com[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.