CVE-2024-53907

Dec. 31, 2024, 6:15 p.m.

7.5
High

Description

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

Product(s) Impacted

Product Versions
Django
  • 4.2
  • 5.0
  • 5.1 before 5.1.4

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/g/django-announce
https://www.openwall.com/lists/oss-security/2024/12/04/3
https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html

Tags

cve@mitre.org
CWE-770
2024-12-06
CVE-2024-53907

CVSS Score

7.5 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Date

  • Published: Dec. 6, 2024, 12:15 p.m.
  • Last Modified: Dec. 31, 2024, 6:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.