CVE-2021-33203
Publication date 2 June 2021
Last updated 25 August 2025
Ubuntu priority
Description
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| python-django | 22.04 LTS jammy |
Fixed in 2:2.2.24-1
|
| 20.04 LTS focal |
Fixed in 2:2.2.12-1ubuntu0.7
|
|
| 18.04 LTS bionic |
Fixed in 1:1.11.11-1ubuntu1.14
|
|
| 16.04 LTS xenial |
Fixed in 1.8.7-1ubuntu5.15+esm3
|
|
| 14.04 LTS trusty |
Not affected
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
4.9 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-4975-1
- Django vulnerabilities
- 2 June 2021
- USN-4975-2
- Django vulnerability
- 7 June 2021