Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-0481

The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.

Published

2014-08-26T14:55:05.250

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-399
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System opensuse opensuse 13.1 Yes
Operating System opensuse_project opensuse 12.3 Yes
Application djangoproject django ≤ 1.4.13 Yes
Application djangoproject django 1.4 Yes
Application djangoproject django 1.4.1 Yes
Application djangoproject django 1.4.2 Yes
Application djangoproject django 1.4.4 Yes
Application djangoproject django 1.4.5 Yes
Application djangoproject django 1.4.6 Yes
Application djangoproject django 1.4.7 Yes
Application djangoproject django 1.4.8 Yes
Application djangoproject django 1.4.9 Yes
Application djangoproject django 1.4.10 Yes
Application djangoproject django 1.4.11 Yes
Application djangoproject django 1.4.12 Yes
Application djangoproject django 1.5 Yes
Application djangoproject django 1.5 Yes
Application djangoproject django 1.5 Yes
Application djangoproject django 1.5.1 Yes
Application djangoproject django 1.5.2 Yes
Application djangoproject django 1.5.3 Yes
Application djangoproject django 1.5.4 Yes
Application djangoproject django 1.5.5 Yes
Application djangoproject django 1.5.6 Yes
Application djangoproject django 1.5.7 Yes
Application djangoproject django 1.5.8 Yes
Application djangoproject django 1.7 Yes
Application djangoproject django 1.7 Yes
Application djangoproject django 1.7 Yes
Application djangoproject django 1.7 Yes
Application djangoproject django 1.7 Yes
Application djangoproject django 1.7 Yes
Application djangoproject django 1.6 Yes
Application djangoproject django 1.6 Yes
Application djangoproject django 1.6 Yes
Application djangoproject django 1.6 Yes
Application djangoproject django 1.6 Yes
Application djangoproject django 1.6.1 Yes
Application djangoproject django 1.6.2 Yes
Application djangoproject django 1.6.3 Yes
Application djangoproject django 1.6.4 Yes
Application djangoproject django 1.6.5 Yes
Operating System debian debian_linux 7.0 Yes
References