Information Exposure Affecting djangorestframework-simplejwt package, versions [0,]


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Mature
EPSS
0.08% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-DJANGORESTFRAMEWORKSIMPLEJWT-6450220
  • published9 Sept 2024
  • disclosed16 Mar 2024
  • creditUnknown

Introduced: 16 Mar 2024

CVE-2024-22513  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

There is no fixed version for djangorestframework-simplejwt.

Overview

djangorestframework-simplejwt is an A minimal JSON Web Token authentication plugin for Django REST Framework

Affected versions of this package are vulnerable to Information Exposure due to improper handling of sensitive information. An attacker can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

Workaround

Ensure that before generating an access token for a user, there is a thorough verification process to determine whether the user is active or not. This validation step is essential in preventing unauthorized access and helps mitigate the vulnerability associated with the lack of user inactivity validation in the mentioned functionality. Implementing this check adds an extra layer of security to your application.

from django.contrib.auth.models import User
from rest_framework_simplejwt.tokens import AccessToken

user = User.objects.get(id=inactive_user_id)

if user and user.is_active: token = AccessToken.for_user(user)

CVSS Scores

version 3.1