CVE-2020-24584: Incorrect Default Permissions in Django
Summary
CVE-2020-24584: Django Incorrect Default Permissions. Affects django across 3 version ranges.
>= 2.2, < 2.2.16
>= 3.0, < 3.0.10
>= 3.1, < 3.1.1
Fixed in 2.2.16, 3.0.10 or 3.1.1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-24584 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a high-level development environment and follows the model-view-controller architectural pattern. Django is widely adopted due to its robustness, scalability, and security features. However, a vulnerability has been discovered in Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).
Vulnerability Detail
The vulnerability, identified as CVE-2020-24584, stems from incorrect default permissions in the intermediate-level directories of the filesystem cache. These directories inherit the system's standard umask rather than having the appropriate permissions set to 0o077. This misconfiguration can lead to unauthorized access and potential information disclosure. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.162.2.16pip install --upgrade "django==2.2.16" -
>= 3.0, < 3.0.103.0.10pip install --upgrade "django==3.0.10" -
>= 3.1, < 3.1.13.1.1pip install --upgrade "django==3.1.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade Django to the fixed versions mentioned above.
Conclusion
In conclusion, the vulnerability CVE-2020-24584 in Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used) exposes the intermediate-level directories of the filesystem cache to incorrect default permissions. This can result in unauthorized access and potential information disclosure. It is crucial to upgrade Django to the fixed versions to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies web development by providing a high-level development environment and following the model-view-controller architectural pattern.
The vulnerability can lead to unauthorized access and potential information disclosure in Django applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can find more information about this vulnerability in the GitHub Advisory Database at the following source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-fr28-569j-53c4/GHSA-fr28-569j-53c4.json
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
