CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2021-33571
High (7.5). EPSS 5.3% chance of exploitation in the next 30 days. Fixed in django 2.2.24, 3.1.12, 3.2.4.
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
Severity
- EPSS
- 5.3% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
- fedoraproject:fedora
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p99v-5w3c-jqq9 | PyPI | django | >=2.2a1 <2.2.24 | 2.2.24 |
| GHSA-p99v-5w3c-jqq9 | PyPI | django | >=3.0a1 <3.1.12 | 3.1.12 |
| GHSA-p99v-5w3c-jqq9 | PyPI | django | >=3.2a1 <3.2.4 | 3.2.4 |
| PYSEC-2021-99 | PyPI | django | >=2.2 <2.2.24 >=3.0 <3.1.12 >=3.2 <3.2.4 | 2.2.24, 3.1.12, 3.2.4 |
References
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e
- https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
- https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc
- https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo