Vulnerabilities > CVE-2021-33571 - Server-Side Request Forgery (SSRF) vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

djangoproject

fedoraproject

CWE-918

NVD

Published: 2021-06-08

Updated: 2023-12-07

Summary

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

Vulnerable Configurations

Part	Description	Count
Application	Djangoproject Djangoproject Django 3.2 Djangoproject Django 3.2.1 Djangoproject Django 3.2.2 Djangoproject Django 3.2.3 Djangoproject Django 3.0 Djangoproject Django 3.0.1 Djangoproject Django 3.0.2 Djangoproject Django 3.0.3 Djangoproject Django 3.0.4 Djangoproject Django 3.0.5 Djangoproject Django 3.0.6 Djangoproject Django 3.0.7 Djangoproject Django 3.0.8 Djangoproject Django 3.0.9 Djangoproject Django 3.0.10 Djangoproject Django 3.0.11 Djangoproject Django 3.0.12 Djangoproject Django 3.0.13 Djangoproject Django 3.0.14 Djangoproject Django 3.1 Djangoproject Django 3.1.1 Djangoproject Django 3.1.2 Djangoproject Django 3.1.3 Djangoproject Django 3.1.4 Djangoproject Django 3.1.5 Djangoproject Django 3.1.6 Djangoproject Django 3.1.7 Djangoproject Django 3.1.8 Djangoproject Django 3.1.9 Djangoproject Django 3.1.10 Djangoproject Django 3.1.11 Djangoproject Django 2.2 Djangoproject Django 2.2.1 Djangoproject Django 2.2.2 Djangoproject Django 2.2.3 Djangoproject Django 2.2.4 Djangoproject Django 2.2.5 Djangoproject Django 2.2.6 Djangoproject Django 2.2.7 Djangoproject Django 2.2.8 Djangoproject Django 2.2.9 Djangoproject Django 2.2.10 Djangoproject Django 2.2.11 Djangoproject Django 2.2.13 Djangoproject Django 2.2.14 Djangoproject Django 2.2.15 Djangoproject Django 2.2.16 Djangoproject Django 2.2.17 Djangoproject Django 2.2.18 Djangoproject Django 2.2.19 Djangoproject Django 2.2.20 Djangoproject Django 2.2.21 Djangoproject Django 2.2.22 Djangoproject Django 2.2.23	57
OS	Fedoraproject Fedoraproject Fedora 35	1

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References