PYSEC-2021-336

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/django-widgy/PYSEC-2021-336.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2021-336

Aliases

Published

2021-08-16T18:15:00Z

Modified

2023-11-08T04:02:44.467131Z

Summary

[none]

Details

Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'.

References

Affected packages

PyPI / django-widgy

Package

Name: django-widgy; View open source insights on deps.dev
Purl: pkg:pypi/django-widgy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.0

Affected versions

0.*

0.1.0

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.2.0

0.3.0

0.3.1

0.3.2

0.3.3

0.3.4

0.3.5

0.4.0

0.5.0

0.6.0

0.6.1

0.7.0

0.7.1

0.7.2

0.7.3

0.7.4

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/django-widgy/PYSEC-2021-336.yaml"