BIT-django-2020-24583

BIT-django-2020-24583 PUBLISHED CVSS 7.5 HIGH

Record from OSV · Published March 6, 2024

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
django	Bitnami	3.1.1, 3.0.10, 2.2.16

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Vendor	Product	Versions
Bitnami	django	2.2.0, 3.1.0, 3.0.0

Timeline

Mar 6, 2024 CVE Published
Apr 3, 2025 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln BIT-django-2020-24583
vulnetix vdb fixes BIT-django-2020-24583

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/BIT-django-2020-24583/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →