{"cve":"CVE-2021-33571","nvd":{"published":"2021-06-08T18:15:08.517","modified":"2026-06-17T03:54:48.600","status":"Modified","description":"In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-918"],"references":["https://docs.djangoproject.com/en/3.2/releases/security/","https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e","https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d","https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc","https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo"],"products":["djangoproject:django","fedoraproject:fedora"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-33571","score":0.0526,"percentile":0.92549,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-p99v-5w3c-jqq9","url":"https://osv.dev/vulnerability/GHSA-p99v-5w3c-jqq9","summary":"Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks ","modified":"2024-09-20T16:08:23.035684Z","packages":[{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=2.2a1 <2.2.24"],"fixed":["2.2.24"]},{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=3.0a1 <3.1.12"],"fixed":["3.1.12"]},{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=3.2a1 <3.2.4"],"fixed":["3.2.4"]}]},{"id":"PYSEC-2021-99","url":"https://osv.dev/vulnerability/PYSEC-2021-99","summary":"","modified":"2023-12-06T01:01:16.815257Z","packages":[{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=2.2 <2.2.24",">=3.0 <3.1.12",">=3.2 <3.2.4"],"fixed":["2.2.24","3.1.12","3.2.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}