p PatchFirst

CVE-2011-0698

CVE-2011-0698

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.

CVSS 9.3 · Critical · EPSS 2.9% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • django PyPI

    Versions
    • 1.1
    • 1.1.1
    • 1.1.2
    • 1.1.3
    Affected ranges
    • ECOSYSTEM: ≥ 1.1, < 1.1.4

    Update to 1.1.4

  • django PyPI

    Versions
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.2.4
    Affected ranges
    • ECOSYSTEM: ≥ 1.2, < 1.2.5

    Update to 1.2.5

  • django PyPI

    Versions
    • 1.1
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.2.4
    Affected ranges
    • ECOSYSTEM: ≥ 1.1, < 1.1.4 ∪ ≥ 1.2, < 1.2.5

    Update to 1.1.4; Update to 1.2.5

Original sources

Check your server →