p PatchFirst

CVE-2024-21543

CVE-2024-21543

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.

CVSS 5.7 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • djoser

    Versions
    • ≥ 0, < 2.3.0: Affected (semver)

    Update to 2.3.0

  • djoser Debian:12

    Versions
    • 2.1.0-1
    Affected ranges
    • ECOSYSTEM: < 2.1.0-1+deb12u1

    Update to 2.1.0-1+deb12u1

  • djoser Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.3.1-1

    Update to 2.3.1-1

  • djoser Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.3.1-1

    Update to 2.3.1-1

  • djoser PyPI

    Versions
    • 0.0.1
    • 0.0.2
    • 0.0.3
    • 0.1.0
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.6.0
    • 0.7.0
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.2.2
    • 1.3.3
    • 1.4.1
    • 1.5.1
    • 1.6.0
    • 1.7.0
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.1.0
    • 2.2.0
    • 2.2.0a0
    • 2.2.1
    • 2.2.2
    • 2.2.3
    Affected ranges
    • ECOSYSTEM: < 2.3.0

    Update to 2.3.0

  • djoser PyPI

    Versions
    • 0.0.1
    • 0.0.2
    • 0.0.3
    • 0.1.0
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.6.0
    • 0.7.0
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.2.2
    • 1.3.3
    • 1.4.1
    • 1.5.1
    • 1.6.0
    • 1.7.0
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.1.0
    • 2.2.0
    • 2.2.0a0
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 1.4.0
    • 1.3.2
    • 1.2.1
    • 1.5.0
    • 1.3.1
    • 1.3.0
    Affected ranges
    • GIT: < d33c3993c0c735f23cbedc60fa59fce69354f19d
    • ECOSYSTEM: < 2.3.0

    Update to 2.3.0

  • djoser Ubuntu:Pro:20.04:LTS

    Versions
    • 2.0.1-2
    • 2.0.3-1
    Affected ranges
    • ECOSYSTEM: < 2.0.3-1ubuntu0.1~esm1

    Update to 2.0.3-1ubuntu0.1~esm1

  • djoser Ubuntu:22.04:LTS

    Versions
    • 2.1.0-1
    Affected ranges
    • ECOSYSTEM: < 2.1.0-1ubuntu0.22.04.1

    Update to 2.1.0-1ubuntu0.22.04.1

  • djoser Ubuntu:24.04:LTS

    Versions
    • 2.1.0-1
    Affected ranges
    • ECOSYSTEM: < 2.1.0-1ubuntu0.24.04.1

    Update to 2.1.0-1ubuntu0.24.04.1

Original sources

Check your server →