CVE-2024-21543

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-287 CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Dec 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-215448.6Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the se CVE-2024-215458.2Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against mali CVE-2024-215469.8Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimety CVE-2024-215477.5Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where CVE-2024-215487.5Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An atta CVE-2024-215498.6Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the se CVE-2024-21554.3A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown pr CVE-2024-215506.1SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central ser CVE-2024-215529.8All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the CVE-2024-21569.8A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2024-215718.1Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to exec CVE-2024-2157410.0The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom