Home > Vulnerability Database > CVE-2021-44420

Mend.io Vulnerability Database

CVE-2021-44420

Good to know:

Date: December 7, 2021

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

Language: Python

Severity Score

7.3

Related Resources (17)

Url: https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-439.yaml

Url: https://security.netapp.com/advisory/ntap-20211229-0006

Url: https://github.com/django/django

Url: https://www.openwall.com/lists/oss-security/2021/12/07/1

Url: https://docs.djangoproject.com/en/3.2/releases/security/

Url: https://github.com/advisories/GHSA-v6rh-hp5x-86rv

Url: https://www.djangoproject.com/weblog/2021/dec/07/security-releases/

Url: https://groups.google.com/forum/#!forum/django-announce

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV

Url: https://docs.djangoproject.com/en/3.2/releases/security

Url: https://www.djangoproject.com/weblog/2021/dec/07/security-releases

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-44420

Url: https://groups.google.com/forum/#%21forum/django-announce

Url: https://security.netapp.com/advisory/ntap-20211229-0006/

Url: https://github.com/django/django/commit/d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6

Url: https://www.mend.io/vulnerability-database/CVE-2021-44420

Severity Score

7.3

Weakness Type (CWE)

Improper Authentication

CWE-287

Top Fix

Upgrade Version

Upgrade to version Django - 3.1.14;Django - 3.2.10;Django - 2.2.25;django - 2.0.2

Learn More

CVSS v3.1

Base Score:	7.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2021-44420

Good to know:

Date: December 7, 2021

Language: Python

Severity Score

Related Resources (17)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?