CVE-2021-33203

NameCVE-2021-33203
DescriptionDjango before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2676-1
Debian Bugs989394

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-django (PTS)buster1:1.11.29-1~deb10u1vulnerable
buster (security)1:1.11.29-1+deb10u5vulnerable
bullseye2:2.2.26-1~deb11u1fixed
bullseye (security)2:2.2.28-1~deb11u1fixed
bookworm, sid3:3.2.16-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-djangosourcestretch1:1.10.7-2+deb9u14DLA-2676-1
python-djangosource(unstable)2:2.2.24-1989394

Notes

[buster] - python-django <no-dsa> (Minor issue)
https://www.openwall.com/lists/oss-security/2021/06/02/1
https://github.com/django/django/commit/46572de2e92fdeaf047f80c44d52269e54ad68db (main)
https://github.com/django/django/commit/053cc9534d174dc89daba36724ed2dcb36755b90 (2.2.24)

Search for package or bug name: Reporting problems