Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-jhen-vhqx-n7dr
Summary
Improper Privilege Management
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
Aliases
0
alias CVE-2024-21622
1
alias GHSA-j5g9-j7r4-6qvx
Fixed_packages
0
url pkg:composer/craftcms/cms@3.9.6
purl pkg:composer/craftcms/cms@3.9.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.9.6
1
url pkg:composer/craftcms/cms@4.5.11
purl pkg:composer/craftcms/cms@4.5.11
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.5.11
Affected_packages
0
url pkg:composer/craftcms/cms@3.0.0
purl pkg:composer/craftcms/cms@3.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3twn-e7up-2ugq
1
vulnerability VCID-5mnd-qvaq-k3am
2
vulnerability VCID-6hcd-ayyh-3fdb
3
vulnerability VCID-c2nk-y4rx-1qf4
4
vulnerability VCID-ec34-nvn3-qbcb
5
vulnerability VCID-hm7h-7cu3-8be1
6
vulnerability VCID-jhen-vhqx-n7dr
7
vulnerability VCID-xv52-rc7v-yba8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.0.0
1
url pkg:composer/craftcms/cms@3.9.5
purl pkg:composer/craftcms/cms@3.9.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-jhen-vhqx-n7dr
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@3.9.5
2
url pkg:composer/craftcms/cms@4.0.0-RC1
purl pkg:composer/craftcms/cms@4.0.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1468-4fdx-kbfr
1
vulnerability VCID-1mb5-28xp-ckd2
2
vulnerability VCID-2vn9-2cs3-vbg3
3
vulnerability VCID-5cxe-tjpb-3qan
4
vulnerability VCID-71sv-62m4-z3er
5
vulnerability VCID-7y4f-ef7t-47eb
6
vulnerability VCID-8u2j-17a4-q7eh
7
vulnerability VCID-9enr-b6zd-mbh8
8
vulnerability VCID-akrv-yqnf-1kg8
9
vulnerability VCID-azr5-12f8-hfbm
10
vulnerability VCID-c2nk-y4rx-1qf4
11
vulnerability VCID-cys8-jnmu-77ec
12
vulnerability VCID-ec34-nvn3-qbcb
13
vulnerability VCID-f7gc-cgka-tycr
14
vulnerability VCID-h6t5-pdp5-8qhe
15
vulnerability VCID-hyct-5gap-7kdu
16
vulnerability VCID-jeyh-3jxd-z3g6
17
vulnerability VCID-jhen-vhqx-n7dr
18
vulnerability VCID-jsfs-azcs-mfcm
19
vulnerability VCID-jxz8-g6fq-dubw
20
vulnerability VCID-kbrc-85av-nfcn
21
vulnerability VCID-m5rf-usae-yfb7
22
vulnerability VCID-ppet-ruae-1kav
23
vulnerability VCID-qq68-3j4y-47am
24
vulnerability VCID-qwmy-d2e8-5khw
25
vulnerability VCID-qywv-vf4r-8bh9
26
vulnerability VCID-r5hp-5nju-9ubz
27
vulnerability VCID-twuy-wzb7-k7g3
28
vulnerability VCID-vasz-rnn1-67ev
29
vulnerability VCID-w9yn-1573-hyau
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.0.0-RC1
3
url pkg:composer/craftcms/cms@4.5.10
purl pkg:composer/craftcms/cms@4.5.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-jhen-vhqx-n7dr
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/craftcms/cms@4.5.10
References
0
reference_url https://github.com/craftcms/cms
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms
1
reference_url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16
2
reference_url https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
3
reference_url https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa
4
reference_url https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843
5
reference_url https://github.com/craftcms/cms/pull/13931
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/pull/13931
6
reference_url https://github.com/craftcms/cms/pull/13932
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/pull/13932
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-21622
reference_id CVE-2024-21622
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-21622
8
reference_url https://github.com/advisories/GHSA-j5g9-j7r4-6qvx
reference_id GHSA-j5g9-j7r4-6qvx
reference_type
scores
url https://github.com/advisories/GHSA-j5g9-j7r4-6qvx
9
reference_url https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx
reference_id GHSA-j5g9-j7r4-6qvx
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 269
name Improper Privilege Management
description The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-jhen-vhqx-n7dr