Improper Privilege Management in djangorestframework-simplejwt

2024-03-1609:30:35

Google

osv.dev

improper privilege management

information disclosure

djangorestframework-simplejwt

v5.3.1

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.8%

JSON

djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

CPENameOperatorVersion
djangorestframework-simplejwteq2.0.3
djangorestframework-simplejwteq2.1
djangorestframework-simplejwteq4.1.2
djangorestframework-simplejwteq4.7.2
djangorestframework-simplejwteq5.1.0
djangorestframework-simplejwteq3.2.1
djangorestframework-simplejwteq5.0.0
djangorestframework-simplejwteq2.0.1
djangorestframework-simplejwteq4.1.0
djangorestframework-simplejwteq1.5

Name	Operator	Version
djangorestframework-simplejwt	eq	2.0.3
djangorestframework-simplejwt	eq	2.1
djangorestframework-simplejwt	eq	4.1.2
djangorestframework-simplejwt	eq	4.7.2
djangorestframework-simplejwt	eq	5.1.0
djangorestframework-simplejwt	eq	3.2.1
djangorestframework-simplejwt	eq	5.0.0
djangorestframework-simplejwt	eq	2.0.1
djangorestframework-simplejwt	eq	4.1.0
djangorestframework-simplejwt	eq	1.5