Vulnerability Details : CVE-2023-24580
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Vulnerability category: Denial of service
Products affected by CVE-2023-24580
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-24580
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 65 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-24580
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2023-24580
-
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-24580
-
https://www.djangoproject.com/weblog/2023/feb/14/security-releases/
Django security releases issued: 4.1.7, 4.0.10, and 3.2.18 | Weblog | DjangoPatch;Release Notes;Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/
[SECURITY] Fedora 37 Update: python-django3-3.2.18-1.fc37 - package-announce - Fedora Mailing-Lists
-
https://docs.djangoproject.com/en/4.1/releases/security/
Archive of security issues | Django documentation | DjangoPatch;Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2023/02/14/1
oss-security - Django - CVE-2023-24580: Potential denial-of-service vulnerability in file uploadsMailing List;Release Notes;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html
[SECURITY] [DLA 3329-1] python-django security updateMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
[SECURITY] Fedora 37 Update: python-django-4.0.10-1.fc37 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/
[SECURITY] Fedora 36 Update: python-django3-3.2.18-1.fc36 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/
[SECURITY] Fedora 38 Update: python-django3-3.2.18-1.fc38 - package-announce - Fedora Mailing-Lists
-
https://security.netapp.com/advisory/ntap-20230316-0006/
CVE-2023-24580 Django Vulnerability in NetApp Products | NetApp Product Security
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
[SECURITY] Fedora 38 Update: python-django-4.0.10-1.fc38 - package-announce - Fedora Mailing-Lists
-
https://groups.google.com/forum/#!forum/django-announce
django-announce - Google GroupsRelease Notes
Jump to