Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2024-22513

HistoryMar 16, 2024 - 7:15 a.m.

CVE-2024-22513

2024-03-1607:15:06

Debian Security Bug Tracker

security-tracker.debian.org

djangorestframework-simplejwt

vulnerability

information disclosure

user validation

6.3 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.8%

JSON

djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

OSVersionArchitecturePackageVersionFilename
Debian12allpython-djangorestframework-simplejwt<= 5.2.2-1python-djangorestframework-simplejwt_5.2.2-1_all.deb
Debian999allpython-djangorestframework-simplejwt<= 5.3.1-1python-djangorestframework-simplejwt_5.3.1-1_all.deb
Debian13allpython-djangorestframework-simplejwt<= 5.3.1-1python-djangorestframework-simplejwt_5.3.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	python-djangorestframework-simplejwt	<= 5.2.2-1	python-djangorestframework-simplejwt_5.2.2-1_all.deb
Debian	999	all	python-djangorestframework-simplejwt	<= 5.3.1-1	python-djangorestframework-simplejwt_5.3.1-1_all.deb
Debian	13	all	python-djangorestframework-simplejwt	<= 5.3.1-1	python-djangorestframework-simplejwt_5.3.1-1_all.deb