Lucene search

GitHub Advisory DatabaseGHSA-5VCC-86WM-547Q

HistoryMar 16, 2024 - 9:30 a.m.

Improper Privilege Management in djangorestframework-simplejwt

2024-03-1609:30:35

CWE-269

GitHub Advisory Database

github.com

vulnerability

information disclosure

privilege management

user validation checks

for_user method

djangorestframework-simplejwt

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.8%

JSON

djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

Affected configurations

Vulners

Node

djangorestframeworksimplejwtRange≤5.3.1

CPENameOperatorVersion
djangorestframework-simplejwtle5.3.1

CPE	Name	Operator	Version
	djangorestframework-simplejwt	le	5.3.1

References

github.com/advisories/GHSA-5vcc-86wm-547q

github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513

github.com/jazzband/djangorestframework-simplejwt/blob/c791e987332ed5e22a86428160d6372b1d85ffae/rest_framework_simplejwt/tokens.py#L281

nvd.nist.gov/vuln/detail/CVE-2024-22513