Access Restriction Bypass Affecting django package, versions [,2.2.25) [3.0,3.1.14) [3.2,3.2.10)
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.11% (44th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-DJANGO-2312875
- published 8 Dec 2021
- disclosed 8 Dec 2021
- credit Sjoerd Job Postmus, TengMA
Introduced: 8 Dec 2021
CVE-2021-44420 Open this link in a new tabHow to fix?
Upgrade Django
to version 2.2.25, 3.1.14, 3.2.10 or higher.
Overview
Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.
Affected versions of this package are vulnerable to Access Restriction Bypass. HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.