Back to Database
Status published
Medium
CVE-2013-4315
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before...
Vulnerability Description
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-4315
Credits & Attribution
No credits recorded in the NVD database.
References
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
- http://secunia.com/advisories/54772
- http://rhn.redhat.com/errata/RHSA-2013-1521.html
- https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/
- http://secunia.com/advisories/54828
- http://www.debian.org/security/2013/dsa-2755
More from djangoproject
View All →CVE-2025-64460
Potential denial-of-service vulnerability in XML serializer text extraction
Unknown
0
CVE-2025-64459
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
Unknown
0
CVE-2025-64458
Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
Unknown
0
CVE-2025-59682
An issue was discovered in Django 4.2 before 4.2.25, 5.1...
Low
3.1
CVE-2025-59681
An issue was discovered in Django 4.2 before 4.2.25, 5.1...
High
7.1
Affected Vendor
djangoproject
View all reports →Affected Software
django
Vulnerable Versions:
1.4, 1.4.1, 1.4.2, 1.4.4, 1.4.5, 1.4.6, 1.5, 1.5.1, 1.6
Timeline
Official Publish:
September 16th, 2013
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.