CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2021-44420
High (7.3). EPSS 2.4% chance of exploitation in the next 30 days. Fixed in django 2.2.25, 3.1.14, 3.2.10.
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
Severity
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- djangoproject:django
- fedoraproject:fedora
- redhat:satellite
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v6rh-hp5x-86rv | PyPI | django | >=2.2a1 <2.2.25 | 2.2.25 |
| GHSA-v6rh-hp5x-86rv | PyPI | django | >=3.0a1 <3.1.14 | 3.1.14 |
| GHSA-v6rh-hp5x-86rv | PyPI | django | >=3.2a1 <3.2.10 | 3.2.10 |
| PYSEC-2021-439 | PyPI | django | >=2.2 <2.2.25 >=3.1 <3.1.14 >=3.2 <3.2.10 | 2.2.25, 3.1.14, 3.2.10 |
References
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20211229-0006/
- https://www.djangoproject.com/weblog/2021/dec/07/security-releases/