CVE-2023-31047

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

3591e1c1acbd7c13174275367c3fdf012cb0413b

Fixed

fc42edd2e63e89a80e7ca81486291f74359ef8be

Introduced

ef62a3a68c9d558486145a42c0d71ea9a76add9e

Fixed

dceb634ba42d3a182ea653dce31a529017f75a95

Introduced

Last affected

879e5d587b84e6fc961829611999431778eb9f6a

Introduced

Last affected

6234acb7176a75b4b75d6bc5f48faf4224bbdc63

Introduced

Last affected

e829b0a239cffdeab5781df450a6b0e0026faa2d

Database specific

{
    "versions": [
        {
            "introduced": "3.2"
        },
        {
            "fixed": "3.2.19"
        },
        {
            "introduced": "4.0"
        },
        {
            "fixed": "4.1.9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.2-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.2-b1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.2-rc1"
        }
    ]
}

Affected versions

1.*

1.0

1.0.1

1.0.2

1.0.3

1.0.4

1.1

1.1.1

1.1.2

1.1.3

1.1.4

1.10

1.10.1

1.10.2

1.10.3

1.10.4

1.10.5

1.10.6

1.10.7

1.10.8

1.10a1

1.10b1

1.10rc1

1.11

1.11.1

1.11.10

1.11.11

1.11.12

1.11.13

1.11.14

1.11.15

1.11.16

1.11.17

1.11.18

1.11.19

1.11.2

1.11.20

1.11.21

1.11.22

1.11.23

1.11.24

1.11.25

1.11.26

1.11.27

1.11.28

1.11.29

1.11.3

1.11.4

1.11.5

1.11.6

1.11.7

1.11.8

1.11.9

1.11a1

1.11b1

1.11rc1

1.2

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.3

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4

1.4.1

1.4.10

1.4.11

1.4.12

1.4.13

1.4.14

1.4.15

1.4.16

1.4.17

1.4.18

1.4.19

1.4.2

1.4.20

1.4.21

1.4.22

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5

1.5.1

1.5.10

1.5.11

1.5.12

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.5a1

1.5b1

1.5b2

1.5c1

1.5c2

1.6

1.6.1

1.6.10

1.6.11

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.6a1

1.6b1

1.6b2

1.6b3

1.6b4

1.6c1

1.7

1.7.1

1.7.10

1.7.11

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7a1

1.7a2

1.7b1

1.7b2

1.7b3

1.7b4

1.7c1

1.7c2

1.7c3

1.8

1.8.1

1.8.10

1.8.11

1.8.12

1.8.13

1.8.14

1.8.15

1.8.16

1.8.17

1.8.18

1.8.19

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.8a1

1.8b1

1.8b2

1.8c1

1.9

1.9.1

1.9.10

1.9.11

1.9.12

1.9.13

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

1.9a1

1.9b1

1.9rc1

1.9rc2

2.*

2.0

2.0.1

2.0.10

2.0.11

2.0.12

2.0.13

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0a1

2.0b1

2.0rc1

2.1

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1a1

2.1b1

2.1rc1

2.2

2.2.1

2.2.10

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

2.2.18

2.2.19

2.2.2

2.2.20

2.2.21

2.2.22

2.2.23

2.2.24

2.2.25

2.2.26

2.2.27

2.2.28

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2a1

2.2b1

2.2rc1

3.*

3.0

3.0.1

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0a1

3.0b1

3.0rc1

3.1

3.1.1

3.1.10

3.1.11

3.1.12

3.1.13

3.1.14

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.1a1

3.1b1

3.1rc1

3.2

3.2.1

3.2.10

3.2.11

3.2.12

3.2.13

3.2.14

3.2.15

3.2.16

3.2.17

3.2.18

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.2.9

3.2a1

3.2b1

3.2rc1

4.*

4.0

4.0.1

4.0.10

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.0a1

4.0b1

4.0rc1

4.1

4.1.1

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.1.7

4.1.8

4.1a1

4.1b1

4.1rc1

4.2a1

4.2b1

5.*

5.0

5.0.1

5.0.10

5.0.11

5.0.12

5.0.13

5.0.14

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.0a1

5.0b1

5.0rc1

5.1

5.1.1

5.1.10

5.1.11

5.1.12

5.1.13

5.1.14

5.1.15

5.1.2

5.1.3

5.1.4

5.1.5

5.1.6

5.1.7

5.1.8

5.1.9

5.1a1

5.1b1

5.1rc1

5.2

5.2.1

5.2.10

5.2.11

5.2.12

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.2a1

5.2b1

5.2rc1

6.*

6.0

6.0.1

6.0.2

6.0.3

6.0a1

6.0b1

6.0rc1

Other

archive/attic/boulder-oracle-sprint

archive/attic/full-history

archive/attic/generic-auth

archive/attic/gis

archive/attic/i18n

archive/attic/magic-removal

archive/attic/multi-auth

archive/attic/multiple-db-support

archive/attic/new-admin

archive/attic/newforms-admin

archive/attic/per-object-permissions

archive/attic/queryset-refactor

archive/attic/schema-evolution

archive/attic/schema-evolution-ng

archive/attic/search-api

archive/attic/sqlalchemy

archive/attic/unicode

archive/soc2009/admin-ui

archive/soc2009/http-wsgi-improvements

archive/soc2009/i18n-improvements

archive/soc2009/model-validation

archive/soc2009/multidb

archive/soc2009/test-improvements

archive/soc2010/app-loading

archive/soc2010/query-refactor

archive/soc2010/test-refactor

stable/0.*

stable/0.90.x

stable/0.91.x

stable/0.95.x

stable/0.96.x

stable/1.*

stable/1.0.x

stable/1.1.x

stable/1.10.x

stable/1.11.x

stable/1.2.x

stable/1.3.x

stable/1.4.x

stable/1.5.x

stable/1.6.x

stable/1.7.x

stable/1.8.x

stable/1.9.x

stable/2.*

stable/2.0.x

stable/2.1.x

stable/2.2.x

stable/3.*

stable/3.0.x

stable/3.1.x

stable/3.2.x

stable/4.*

stable/4.0.x

stable/5.*

stable/5.0.x

stable/5.1.x

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "38"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31047.json"