Vulnerability Description
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Djangoproject | Django | >= 3.2, < 3.2.19 |
| Fedoraproject | Fedora | 38 |
Related Weaknesses (CWE)
References
- https://docs.djangoproject.com/en/4.2/releases/security/Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20230609-0008/
- https://www.djangoproject.com/weblog/2023/may/03/security-releases/Vendor Advisory
- https://docs.djangoproject.com/en/4.2/releases/security/Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20230609-0008/
- https://www.djangoproject.com/weblog/2023/may/03/security-releases/Vendor Advisory
FAQ
What is CVE-2023-31047?
CVE-2023-31047 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor...
How severe is CVE-2023-31047?
CVE-2023-31047 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-31047?
Check the references section above for vendor advisories and patch information. Affected products include: Djangoproject Django, Fedoraproject Fedora.