CVE-2014-0481

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-26 · updated 2026-06-17
Weakness: CWE-399

Description

The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.

Affected products

Debian Linux: 7.0
Django: through 1.4.13; 1.4, 1.4.1, 1.4.2, 1.4.4, 1.4.5, 1.4.6 (+33)
Opensuse: 13.1
Opensuse Project Opensuse: 12.3

References

http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
http://secunia.com/advisories/59782
http://secunia.com/advisories/61276
http://secunia.com/advisories/61281
http://www.debian.org/security/2014/dsa-3010
https://www.djangoproject.com/weblog/2014/aug/20/security/
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
http://secunia.com/advisories/59782
http://secunia.com/advisories/61276
http://secunia.com/advisories/61281
http://www.debian.org/security/2014/dsa-3010
https://www.djangoproject.com/weblog/2014/aug/20/security/

Get alerted when CVE-2014-0481 or the next vulnerability affects your stack