CVE-2011-0698

Advisory

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0698
• http://www.djangoproject.com/weblog/2011/feb/08/security/
• http://openwall.com/lists/oss-security/2011/02/09/6
• http://www.securityfocus.com/bid/46296
• http://secunia.com/advisories/43230
• http://www.vupen.com/english/advisories/2011/0372
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:031
• http://www.vupen.com/english/advisories/2011/0439