← back
CVE-2024-21543

CVE-2024-21543

CVSS 5.7 MEDIUMEPSS 0.5%CWE-287CWE-295
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.7EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
13 Dec 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
n/a · djoser

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/sunscrapers/djoser/commit/d33c3993c0c735f23cbedc60fa59fce69354f19dhttps://github.com/sunscrapers/djoser/issues/795https://github.com/sunscrapers/djoser/pull/819https://github.com/sunscrapers/djoser/releases/tag/2.3.0https://lists.debian.org/debian-lts-announce/2025/02/msg00023.htmlhttps://security.snyk.io/vuln/SNYK-PYTHON-DJOSER-8366540