Log in Start free

Vulnerability · Published Dec 13, 2024 · Assigned by snyk

CVE-2024-21543

High 7.1

In plain English

A high-severity improper authentication in djoser. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12djoser2.1.0-1+deb12u1DEBIAN-CVE-2024-21543
Debian:13djoser2.3.1-1DEBIAN-CVE-2024-21543
Debian:14djoser2.3.1-1DEBIAN-CVE-2024-21543
PyPIdjoser2.3.0GHSA-v49p-m6gh-747c
PyPIdjoser2.3.0PYSEC-2024-158
Ubuntu:22.04:LTSdjoser2.1.0-1ubuntu0.22.04.1USN-7354-1
Ubuntu:22.04:LTSdjoser2.1.0-1ubuntu0.22.04.1UBUNTU-CVE-2024-21543
Ubuntu:24.04:LTSdjoser2.1.0-1ubuntu0.24.04.1UBUNTU-CVE-2024-21543
Ubuntu:24.04:LTSdjoser2.1.0-1ubuntu0.24.04.1USN-7354-1

Affected products (as reported)

VendorProductVersions
n/a djoser 0 – before 2.3.0

Weakness: CWE-287, CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P

References