CVE-2023-24580

highPriorität · beachten · 52EPSS 0.626 · 99. PerzentilDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
—
no known exploitation
Likely / severe?
62.6% (99th) EPSS
CVSS 7.5 · high
Is it mine?
46 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenpython-django-0:3.2.18-1.0.1.el8ui.src as a component of RHUI 4 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2023:2101
  • Behobenpython39-django-0:3.2.18-1.0.1.el8ui.noarch as a component of RHUI 4 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2023:2101
  • Behobenpython312-Django6-0:6.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenpython312-Django6-0:6.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenpython312-Django6-0:6.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenpython312-Django6-0:6.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenpython313-Django6-0:6.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenpython313-Django6-0:6.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenpython313-Django6-0:6.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenpython313-Django6-0:6.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Hsecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · SUSE Product Security
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Red Hat Product Security US
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-400USprimärCWE-400USCWE-400USCWE-400US
05

betroffene Produkte (46)

Betroffene Produkte und Versionsbereiche.

20 von 46 angezeigt
06

Advisories (8)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2023:2101Red Hat Security Advisory: RHUI 4.4.0 release - Security Fixes, Bug Fixes, and Enhancements Update2023-05-03csaf · redhat_csafUS

    An updated version of Red Hat Update Infrastructure (RHUI) is now available. RHUI 4.4 fixes several security and operational bugs, and introduces multiple new features.

  • WID-SEC-W-2023-0352Django: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-02-13csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Django ausnutzen, um einen Denial of Service Angriff durchzuführen.

  • WID-SEC-W-2023-1143Red Hat Satellite: Mehrere SchwachstellenDeutsch2023-05-03csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder einen Denial of Service Zustand herbeizuführen.

  • WID-SEC-W-2023-1424Xerox FreeFlow Print Server für Solaris: Mehrere SchwachstellenDeutsch2023-06-12csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.

  • openSUSE-SU-2026:10005-1python312-Django6-6.0-1.1 on GA media2026-01-03csaf · suse_csafDE

    python312-Django6-6.0-1.1 on GA media

  • GHSA-2hrw-hx67-34x6Resource exhaustion in Django2023-02-15ghsa · osvUS

    An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

  • BIT-django-2023-245802024-03-06vendor · osvUS

    An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

  • PYSEC-2023-132023-02-15vendor · osvUS

    An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

07

auch bekannt als (8)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundredhat_csafsuse_csafNVDCVE.orgMITRE
veröffentlicht 2023-02-15geändert 2026-06-17
10

Referenzen (38)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan