Search for vulnerabilities
Vulnerability details: VCID-e394-dfbt-aaaj
Vulnerability ID VCID-e394-dfbt-aaaj
Aliases CVE-2009-2659
GHSA-9xg7-gg9m-rmq9
PYSEC-2009-3
Summary The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539134
generic_textual HIGH http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539134
cvssv3.1 7.5 http://code.djangoproject.com/changeset/11353
generic_textual HIGH http://code.djangoproject.com/changeset/11353
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00626 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00662 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00662 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00662 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.00662 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.01859 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
epss 0.05822 https://api.first.org/data/v1/epss?cve=CVE-2009-2659
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=515581
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-9xg7-gg9m-rmq9
cvssv3.1 3.7 https://github.com/django/django
generic_textual MODERATE https://github.com/django/django
cvssv3.1 7.5 https://github.com/django/django/commit/da85d76fd6ca846f3b0ff414e042ddb5e62e2e69
generic_textual HIGH https://github.com/django/django/commit/da85d76fd6ca846f3b0ff414e042ddb5e62e2e69
cvssv3.1 7.5 https://github.com/django/django/commit/df7f917b7f51ba969faa49d000ffc79572c5dcb4
generic_textual HIGH https://github.com/django/django/commit/df7f917b7f51ba969faa49d000ffc79572c5dcb4
cvssv3.1 7.5 https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-3.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-3.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2009-2659
cvssv3.1 7.5 https://web.archive.org/web/20111211001428/http://www.securityfocus.com/bid/35859
generic_textual HIGH https://web.archive.org/web/20111211001428/http://www.securityfocus.com/bid/35859
cvssv3.1 7.5 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00055.html
generic_textual HIGH https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00055.html
cvssv3.1 7.5 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00069.html
generic_textual HIGH https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00069.html
cvssv3.1 7.5 http://www.djangoproject.com/weblog/2009/jul/28/security
generic_textual HIGH http://www.djangoproject.com/weblog/2009/jul/28/security
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2009/07/29/2
generic_textual HIGH http://www.openwall.com/lists/oss-security/2009/07/29/2
Reference id Reference type URL
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539134
http://code.djangoproject.com/changeset/11353
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2659.json
https://api.first.org/data/v1/epss?cve=CVE-2009-2659
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2659
http://secunia.com/advisories/36137
http://secunia.com/advisories/36153
https://github.com/django/django
https://github.com/django/django/commit/da85d76fd6ca846f3b0ff414e042ddb5e62e2e69
https://github.com/django/django/commit/df7f917b7f51ba969faa49d000ffc79572c5dcb4
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-3.yaml
https://web.archive.org/web/20111211001428/http://www.securityfocus.com/bid/35859
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00055.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00069.html
http://www.djangoproject.com/weblog/2009/jul/28/security
http://www.djangoproject.com/weblog/2009/jul/28/security/
http://www.openwall.com/lists/oss-security/2009/07/29/2
http://www.securityfocus.com/bid/35859
515581 https://bugzilla.redhat.com/show_bug.cgi?id=515581
539134 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539134
cpe:2.3:a:django_project:django:0.96:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:django_project:django:0.96:*:*:*:*:*:*:*
cpe:2.3:a:django_project:django:1.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:django_project:django:1.0:*:*:*:*:*:*:*
CVE-2009-2659 https://nvd.nist.gov/vuln/detail/CVE-2009-2659
GHSA-9xg7-gg9m-rmq9 https://github.com/advisories/GHSA-9xg7-gg9m-rmq9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539134
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://code.djangoproject.com/changeset/11353
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/django/django/commit/da85d76fd6ca846f3b0ff414e042ddb5e62e2e69
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/django/django/commit/df7f917b7f51ba969faa49d000ffc79572c5dcb4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-3.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2009-2659
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://web.archive.org/web/20111211001428/http://www.securityfocus.com/bid/35859
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00055.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00069.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.djangoproject.com/weblog/2009/jul/28/security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2009/07/29/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.79376
EPSS Score 0.00626
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.