CVE-2023-24580highCWE-400

CVE-2023-24580

Published · Updated

Follow this CVE+ Monitor python-django+ Monitor django

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 63%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
10 products (21 components)
Red Hat Storage 3 · Red Hat OpenStack Platform 13 (Queens) · Red Hat OpenStack Platform 16.1 · Red Hat OpenStack Platform 16.2 · Red Hat Ansible Automation Platform 2 · and others 5
no_fix_planned: Will not fix
Fixed
4 products (20 components)
Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 9 · Red Hat Satellite 6.13 for RHEL 8 · RHUI 4 for RHEL 8
fix ↗
Not affected
5 products (1,996 components) — because the vulnerable code is not present in the product
Red Hat Satellite 6.13 for RHEL 8 · Red Hat Satellite 6 · RHUI 4 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 9
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a