GitHub Advisoryadvisory · PyPI

GHSA-v49p-m6gh-747c djoser Authentication Bypass

HIGH Published 2024-12-13 Modified 2025-02-21 Official page ↗
Aliases
CVE-2024-21543
Ecosystem
PyPI
Packages
djoser
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-287, CWE-295
Reviewed
2024-12-13

Affected packages

• PyPI djoser: < 2.3.0 → fixed in 2.3.0

Description

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.

Related

Alias · CVE (1)

  • CVE-2024-21543 Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-295 Improper Certificate Validation weakness

References