CVE-2020-24583

HIGH Year: 2020
CVSS v3 Score
7.5
High
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-276
View all →

Vulnerability Description

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.

Related Vulnerabilities

CVE-2010-5108

HIGH
CVSS:7.5(High)

Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permission...

CWE-2762010

CVE-2012-5577

HIGH
CVSS:7.5(High)

Python keyring lib before 0.10 created keyring files with world-readable permissions.

CWE-2762012

CVE-2017-18668

HIGH
CVSS:7.5(High)

An issue was discovered on Samsung mobile devices with M(6.0) software. Attackers can prevent users from making outbound calls and sending outbound text messages. The Samsung ID is SVE-2017-8706 (June...

CWE-2762017

CVE-2017-18669

HIGH
CVSS:7.5(High)

An issue was discovered on Samsung mobile devices with N(7.x) software. Persona has an unprotected API that allows launch of any activity with system privileges. The Samsung ID is SVE-2017-9000 (June ...

CWE-2762017

CVE-2017-4975

HIGH
CVSS:7.5(High)

An issue was discovered in Pivotal PCF Tile Generator versions prior to 6.0.0. Tiles created by the PCF Tile Generator create a running open security group that overrides security groups set by the op...

CWE-2762017

CVE-2018-8848

HIGH
CVSS:7.5(High)

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.

CWE-2762018