PT-2024-18955 · Djoser+3 · Djoser+3

Diego Cebrian · Published 2024-12-13 · Updated 2025-03-24 · CVE-2024-21543

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions djoser versions prior to 2.3.0

Description The issue allows for Authentication Bypass when the authenticate() function fails, causing the system to fall back to querying the database directly. This grants access to users with valid credentials and bypasses custom authentication checks, including two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION BACKENDS.

Recommendations For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue. As a temporary workaround, consider disabling the authenticate() function until a patch is available. Restrict access to custom authentication modules to minimize the risk of exploitation. Avoid relying solely on the AUTHENTICATION BACKENDS for authentication until the issue is resolved.

Fix

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

CVE-2024-21543

DLA-4060-1

GHSA-V49P-M6GH-747C

PYSEC-2024-158

USN-7354-1

Affected Products

Debian

Linuxmint

Ubuntu

Djoser

References · 28

• https://ubuntu.com/security/CVE-2024-21543 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7354-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4060-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-21543 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21543 · Security Note
• https://osv.dev/vulnerability/GHSA-v49p-m6gh-747c · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-21543 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21543 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7354-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-158 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-21543 · Vendor Advisory
• https://github.com/sunscrapers/djoser/releases/tag/2.3.0 · Note
• https://github.com/sunscrapers/djoser/pull/819 · Note
• https://github.com/sunscrapers/djoser/issues/795 · Note