CVE-2024-21543 json
djoser Authentication Bypass
published 2024-12-13 22 mo ago modified 2026-06-17 4 mo ago also GHSA-v49p-m6gh-747c , PYSEC-2024-158 , EUVD-2024-0205
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
Patch / fix
- pypi djoser 2.3.0
- n/a djoser 2.3.0
- djoser Debian 12 2.1.0-1+deb12u1
- djoser Debian 14, Debian 13 2.3.1-1
debian advisories DEBIAN-CVE-2024-21543
- djoser Ubuntu 22.04 LTS 2.1.0-1ubuntu0.22.04.1
- djoser Ubuntu 24.04 LTS 2.1.0-1ubuntu0.24.04.1
- djoser Ubuntu Pro 20.04 LTS 2.0.3-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2024-21543
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/sunscrapers/djoser@d33c399 commit
- github.com/sunscrapers/djoser#819 pull request
- github.com/sunscrapers/djoser/releases/tag/2.3.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 22 mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P |
| CNA | 4.0 | 5.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | djoser | <2.3.0 |
2.3.0 |
Affected products
- n/a djoser
Classification
References
-
github.com
/sunscrapers/djoser/pull/819
web
-
github.com
/sunscrapers/djoser/commit/d33c3993c0c735f23cbedc60fa59fce69354f19d
web, patch
-
security.snyk.io
/vuln/SNYK-PYTHON-DJOSER-8366540
web
-
github.com
/sunscrapers/djoser/releases/tag/2.3.0
web
-
github.com
/sunscrapers/djoser/issues/795
web, report
-
lists.debian.org
/debian-lts-announce/2025/02/msg00023.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-21543
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/djoser/PYSEC-2024-158.yaml
web
-
github.com
/sunscrapers/djoser
package
-
github.com
/advisories/GHSA-v49p-m6gh-747c
advisory
Sources
- CVE List CVE-2024-21543
- GitHub Advisory GHSA-v49p-m6gh-747c
- NVD CVE-2024-21543
- OSV PYSEC-2024-158
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.