CVE-2023-24580

Aliases:GHSA-2hrw-hx67-34x6BIT-django-2023-24580PYSEC-2023-13
Advisory lineage Upstream: 0 Downstream: 18
Modified
Published: 15 Feb 2023, 00:00
Last modified:18 Mar 2025, 19:24

Vulnerability Summary

Overall Risk (default)
medium
34/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
19.67% MEDIUM
20% probability -4.84%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Feb 2023, 00:00
Published
Vulnerability first disclosed
18 Mar 2025, 19:24
Last Modified
Vulnerability information updated

Description

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 19.67%• Percentile: 96%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • debian•debian_linux

    10.0

  • djangoproject•django

    ≥ 3.2, < 3.2.18 | ≥ 4.0, < 4.0.10 | ≥ 4.1, < 4.1.7

  • PyPI•django

    ≥ 3.2a1, < 3.2.18 | ≥ 4.1a1, < 4.1.7 | ≥ 4.0a1, < 4.0.10 | ≥ 4.1, < 4.1.7

References (31)