5.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2018-25111

CVE-2018-25111: django-helpdesk Allows Sensitive Data Exposure

django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2018-25111

CVE-2018-25111:

5.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
django-helpdesk	pip	< 1.0.0	1.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2018-25111 in django-helpdesk (versions prior to 1.0.0) was due to insecure file permissions set when creating attachment directories. The os.umask(0) call, combined with os.makedirs(..., 0o777), resulted in directories being created with world-writable permissions (777). This could allow unauthorized users on the system to access or modify attachments, leading to sensitive data exposure. The fix, identified in commit f872ec252769bee5a88b06d07d3634e580c67bcc, removed the os.umask(0) call and changed the directory creation permissions to a more secure default (755), configurable via HELPDESK_ATTACHMENT_DIR_PERMS. The two functions directly responsible for this behavior were FollowUpAttachment.attachment_path and KBIAttachment.attachment_path in helpdesk/models.py. These functions would be part of the call stack when a new attachment is uploaded and its storage path is determined and created.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.