CVE-2024-21543

CVSS V2 None CVSS V3 None
Description
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
Overview
  • CVE ID
  • CVE-2024-21543
  • Assigner
  • snyk
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-12-13T05:00:16.747Z
  • Last Modified Date
  • 2024-12-13T05:00:16.747Z
History
Created Old Value New Value Data Type Notes
2024-12-13 13:36:17 Added to TrackCVE