{"id":"CVE-2024-21520","aliases":["DEBIAN-CVE-2024-21520","EUVD-2024-2061","GHSA-gw84-84pc-xp82","PYSEC-2026-1304","RHSA-2024:7312","ROOT-APP-PYPI-CVE-2024-21520","UBUNTU-CVE-2024-21520","openSUSE-SU-2026:10115-1"],"status":"published","title":"Cross-site Scripting in djangorestframework","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01133,"percentile":0.66875,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2024-06-26T05:00:02Z","modified":"2026-11-02T12:01:23Z","exploits":[{"source":"pocgithub","id":"ch4n3-yoon/CVE-2024-21520-Demo","title":"ch4n3-yoon/CVE-2024-21520-Demo","date":"2024-05-26","url":"https://github.com/ch4n3-yoon/CVE-2024-21520-Demo"}],"fixes":[{"ecosystem":"PyPI","package":"djangorestframework","fixed_in":["3.15.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"djangorestframework","fixed_in":["3.15.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"djangorestframework","fixed_in":["3.15.2-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"djangorestframework","fixed_in":["3.14.0+aikido.1","3.12.4+aikido.1","3.12.4+aikido.2","3.14.0+aikido.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-djangorestframework","fixed_in":["3.16.1-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-2","3.14.0-2+deb12u1","3.15.1-1","3.15.1-2","3.15.2-1","3.15.2-2","3.16.0-1","3.16.1-1","3.16.1-3","3.16.1-4","3.17.1+ds1-1","3.17.1-1","3.18.1+ds1-1","3.18.3+ds1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2"}]}],"versions":["0.1","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.14","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.13.1","3.14.0","3.15.0","3.15.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.8.0","3.8.1","3.8.2","3.9.0","3.9.1","3.9.2","3.9.3","3.9.4"]},{"source":"osv","ecosystem":"PyPI","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2"}]}],"versions":["0.1","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.14","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.13.1","3.14.0","3.15.0","3.15.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.8.0","3.8.1","3.8.2","3.9.0","3.9.1","3.9.2","3.9.3","3.9.4"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.12-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.12-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:PyPI","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0+aikido.1"},{"fixed":"3.12.4+aikido.1"},{"fixed":"3.12.4+aikido.2"},{"fixed":"3.14.0+aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.3-2","3.3.1-1","3.3.2-1","3.3.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-2","3.7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.0-2","3.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.1-1","3.12.4-1","3.12.4-2","3.12.4-2ubuntu1","3.12.4-2.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-2.1"}]}]}],"products":[{"vendor":"django-rest-framework","product":"django_rest_framework"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORK-7252137","tags":["x_transferred","web","report"]},{"url":"https://github.com/encode/django-rest-framework/pull/9435","tags":["x_transferred","fix","web","report"]},{"url":"https://github.com/encode/django-rest-framework/commit/3b41f0124194430da957b119712978fa2266b642","tags":["x_transferred","fix","web","report"]},{"url":"https://github.com/encode/django-rest-framework/compare/3.15.1...3.15.2","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21520","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gw84-84pc-xp82","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21520.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-21520","tags":["advisory"]},{"url":"https://github.com/encode/django-rest-framework","tags":["package"]},{"url":"https://pypi.org/project/djangorestframework","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7312","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2300497","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7312.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21520","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21520","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-37891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37891","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41810","tags":["advisory"]},{"url":"https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33","tags":["article"]},{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-cf56-g6w6-pqq2","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2024-21520","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21520","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-21520","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2024-06-26T05:00:02.49Z","modified":"2024-12-31T10:10:34.187Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:04.681315Z"}],"euvd":[{"id":"EUVD-2024-2061","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2024-06-26T05:00:02Z","modified":"2024-12-31T10:10:34Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-03T00:04:31.712293Z"}],"ghsa":[{"id":"GHSA-gw84-84pc-xp82","title":"Cross-site Scripting in djangorestframework","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2024-06-26T06:30:29Z","modified":"2024-12-31T15:31:52Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","level":"low"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:26.167657Z"}],"nvd":[{"id":"CVE-2024-21520","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2024-06-26T05:15:50.093Z","modified":"2026-06-17T07:09:40.073Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"CVE-2024-21520","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2024-06-26T05:00:02.49Z","modified":"2026-10-28T02:30:50.914632091Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-21520","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2024-06-26T05:15:50.093Z","modified":"2026-11-02T12:01:23.313427132Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-gw84-84pc-xp82","title":"Cross-site Scripting in djangorestframework","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2024-06-26T06:30:29Z","modified":"2026-07-07T17:57:11.525258427Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"PYSEC-2026-1304","title":"Cross-site Scripting in djangorestframework","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2026-07-07T14:34:35.497172Z","modified":"2026-07-07T17:46:38.015942532Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"RHSA-2024:7312","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-10-01T18:22:49Z","modified":"2026-10-14T10:05:13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-21520","description":"Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with \u003cbr\u003e tags.","status":"published","published":"2024-06-26T05:15:00Z","modified":"2025-10-24T05:06:51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"openSUSE-SU-2026:10115-1","title":"python311-djangorestframework-3.16.1-2.1 on GA media","description":"These are all security issues fixed in the python311-djangorestframework-3.16.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-29T00:00:00Z","modified":"2026-03-23T04:54:28.551714Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"ROOT-APP-PYPI-CVE-2024-21520","title":"CVE-2024-21520 in djangorestframework - Patched by Root","description":"Root has patched CVE-2024-21520 in the djangorestframework package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-28T06:48:53Z","modified":"2026-10-28T07:15:20.364163961Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}