CVE-2020-18704 Unrestricted Upload of File with Dangerous Type in django-widgy
Remote attackers can execute arbitrary code by uploading malicious files via the image widget in the Django-Widgy plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-18704?
CVE-2020-18704 is a critical vulnerability in n/a, published on 16 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'.
Weakness: CWE-434
Which versions are affected by CVE-2020-18704?
3 open source packages ship an affected version, including django-widgy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
django-widgy PyPI | All versions | 0.9.0 |
django-widgy PyPI | All versions | 0.9.0 |
django-widgy PyPI | All versions | 0.9.0 |
Products include Fusionbox Widgy.
How do I fix CVE-2020-18704?
Upgrade django-widgy to 0.9.0 or later.
Is CVE-2020-18704 being exploited?
There is no known exploitation of CVE-2020-18704 in the wild and no public exploit code.
Sources
Also known as GHSA-98hv-qff3-8793, PYSEC-2021-336.