Every CVE Search/ Get API key

CVE-2024-21520

Cross-site Scripting in djangorestframework

5.3 MediumPublic exploitFix available

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.13%Up 1.1 points since Jun 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
CVE-2024-21520
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-2061 5.3

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
EUVD-2024-2061
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P
Updated
2026-11-03
GitHub AdvisoriesGHSA-gw84-84pc-xp82 2.1

Cross-site Scripting in djangorestframework

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
GHSA-gw84-84pc-xp82
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 2.1

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
CVE-2024-21520
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 2.1

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
CVE-2024-21520
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2024-21520 2.1

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
DEBIAN-CVE-2024-21520
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-gw84-84pc-xp82 2.1

Cross-site Scripting in djangorestframework

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
GHSA-gw84-84pc-xp82
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-1304 2.1

Cross-site Scripting in djangorestframework

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
PYSEC-2026-1304
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2024:7312 6.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record
RHSA-2024:7312
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-21520 2.1

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Record
UBUNTU-CVE-2024-21520
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:10115-1 No score

python311-djangorestframework-3.16.1-2.1 on GA media

These are all security issues fixed in the python311-djangorestframework-3.16.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10115-1
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2024-21520 No score

CVE-2024-21520 in djangorestframework - Patched by Root

Root has patched CVE-2024-21520 in the djangorestframework package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2024-21520
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
djangorestframework
PyPI
 before 3.15.2
3.15.2
djangorestframework
Debian:12
 All versions, plus listed versions
3.14.0-23.14.0-2+deb12u13.15.1-13.15.1-23.15.2-1
Show 9 moreShow less
3.15.2-23.16.0-13.16.1-13.16.1-33.16.1-43.17.1+ds1-13.17.1-13.18.1+ds1-13.18.3+ds1-1
 None known
djangorestframework
Debian:13
 before 3.15.2-1
3.15.2-1
djangorestframework
Debian:14
 before 3.15.2-1
3.15.2-1
djangorestframework
PyPI
 before 3.15.2, plus listed versions
0.10.1.10.2.00.2.10.2.2
Show 45 moreShow less
0.2.30.2.40.3.00.3.10.3.20.3.30.4.02.0.02.0.12.0.22.1.02.1.12.1.102.1.112.1.122.1.132.1.142.1.152.1.162.1.172.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.72.3.02.3.12.3.102.3.112.3.122.3.132.3.142.3.22.3.3
3.15.2
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 3 CVEs
 before 0:4.5.12-1.el8ap
0:4.5.12-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 3 CVEs
 before 0:4.5.12-1.el9ap
0:4.5.12-1.el9ap
djangorestframework
Root:PyPI
 before 3.14.0+aikido.1
3.14.0+aikido.13.12.4+aikido.13.12.4+aikido.23.14.0+aikido.2
djangorestframework
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.3-23.3.1-13.3.2-13.3.2-2
 None known
djangorestframework
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.4.0-23.7.7-1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
djangorestframework
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.9.0-23.10.2-1
 None known
djangorestframework
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.12.1-13.12.4-13.12.4-23.12.4-2ubuntu13.12.4-2.1ubuntu1
 None known
djangorestframework
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.14.0-2
 None known
python-djangorestframework
openSUSE:Tumbleweed
 before 3.16.1-2.1
3.16.1-2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubch4n3-yoon/CVE-2024-21520-Demo2024-05-26

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-21520 is a medium vulnerability (CVSS 5.3) in Django-rest-framework Django Rest Framework, published June 26, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in djangorestframework 3.15.2.

References

Show 22 moreShow less
This page doesn't list everything

Left out here: 86 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open