CVE-2024-21543 | THREATINT

Description

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.

Reserved 2023-12-22 | Published 2024-12-13 | Updated 2024-12-13 | Assigner snyk

MEDIUM: 5.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:PHIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P

Problem types

Authentication Bypass

Credits

Diego Cebrian

References

security.snyk.io/vuln/SNYK-PYTHON-DJOSER-8366540

github.com/sunscrapers/djoser/releases/tag/2.3.0

github.com/sunscrapers/djoser/issues/795

github.com/sunscrapers/djoser/pull/819

github.com/...ommit/d33c3993c0c735f23cbedc60fa59fce69354f19d

cve.org (CVE-2024-21543)

nvd.nist.gov (CVE-2024-21543)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.