Catálogo de CVE

CVE-2024-22513

python-djangorestframework-simplejwt affected and fixed versions

[Catálogo de CVE]

djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

Gravidade
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.80% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Opensusetumbleweedpython-djangorestframework-simplejwt5.5.1-1.1UnknownSource applicability is not established[OPENSUSE-SU-2025:15699-1]
Debiantrixiepython-djangorestframework-simplejwtNot reportedAffectedDistribution reports no fix[CVE-2024-22513]
Debiantrixiepython-djangorestframework-simplejwt5.5.0-1Affected[CVE-2024-22513]
Debiansidpython-djangorestframework-simplejwtNot reportedAffectedDistribution reports no fix[CVE-2024-22513]
Debiansidpython-djangorestframework-simplejwt5.5.1-3Affected[CVE-2024-22513]
Debianforkypython-djangorestframework-simplejwtNot reportedAffectedDistribution reports no fix[CVE-2024-22513]
Debianforkypython-djangorestframework-simplejwt5.5.1-3Affected[CVE-2024-22513]
Debianbookwormpython-djangorestframework-simplejwtNot reportedAffectedDistribution reports no fix[CVE-2024-22513]
Debianbookwormpython-djangorestframework-simplejwt5.2.2-1Affected[CVE-2024-22513]
UnknownRelease not reportedpython-djangorestframework-simplejwtNot reportedUnknownSource applicability is not establishedProvider not reported
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedpython-djangorestframework-simplejwtNot reportedUnknownSource applicability is not establishedProvider not reported
Debianbookwormpython-djangorestframework-simplejwtNot reportedAffectedDistribution reports no fix[CVE-2024-22513]
Debianbookwormpython-djangorestframework-simplejwt5.2.2-1Affected[CVE-2024-22513]
Debianforkypython-djangorestframework-simplejwtNot reportedAffectedDistribution reports no fix[CVE-2024-22513]
Debianforkypython-djangorestframework-simplejwt5.5.1-3Affected[CVE-2024-22513]
Debiansidpython-djangorestframework-simplejwtNot reportedAffectedDistribution reports no fix[CVE-2024-22513]
Debiansidpython-djangorestframework-simplejwt5.5.1-3Affected[CVE-2024-22513]
Debiantrixiepython-djangorestframework-simplejwtNot reportedAffectedDistribution reports no fix[CVE-2024-22513]
Debiantrixiepython-djangorestframework-simplejwt5.5.0-1Affected[CVE-2024-22513]
Opensusetumbleweedpython-djangorestframework-simplejwt5.5.1-1.1UnknownSource applicability is not established[OPENSUSE-SU-2025:15699-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "python-djangorestframework-simplejwt",
      "status": "vulnerable",
      "release": "sid",
      "version": "5.5.1-3"
    },
    {
      "name": "python-djangorestframework-simplejwt",
      "status": "vulnerable",
      "release": "forky",
      "version": "5.5.1-3"
    },
    {
      "name": "python-djangorestframework-simplejwt",
      "status": "vulnerable",
      "release": "trixie",
      "version": "5.5.0-1"
    },
    {
      "name": "python-djangorestframework-simplejwt",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "5.2.2-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1067641,
      "name": "python-djangorestframework-simplejwt",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1067641,
      "name": "python-djangorestframework-simplejwt",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1067641,
      "name": "python-djangorestframework-simplejwt",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1067641,
      "name": "python-djangorestframework-simplejwt",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "python-djangorestframework-simplejwt",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "python-djangorestframework-simplejwt",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.1-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2025:15699-1",
      "fixed_version": "5.5.1-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2025:15699-1",
      "provider_updated_at": "2026-02-04T04:32:53.171386Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1067641]

OpenFactory catalog packages

A associação de pacotes está em andamento.

[Debian 12 (Bookworm)]

  • [python3-djangorestframework-simplejwt]Desconhecido

    Pacote fonte: [python-djangorestframework-simplejwt]

    Detalhes (2)

    • 5.2.2-1 · all · bookworm

      Afetada

      dsa · python-djangorestframework-simplejwt · debian · bookworm; dsa · python-djangorestframework-simplejwt · debian · 12

    • 5.2.2-1 · all · bookworm

      Afetada

      dsa · python-djangorestframework-simplejwt · debian · bookworm; dsa · python-djangorestframework-simplejwt · debian · 12

  • [python-djangorestframework-simplejwt-doc]Desconhecido

    Pacote fonte: [python-djangorestframework-simplejwt]

    Detalhes (2)

    • 5.2.2-1 · all · bookworm

      Afetada

      dsa · python-djangorestframework-simplejwt · debian · bookworm; dsa · python-djangorestframework-simplejwt · debian · 12

    • 5.2.2-1 · all · bookworm

      Afetada

      dsa · python-djangorestframework-simplejwt · debian · bookworm; dsa · python-djangorestframework-simplejwt · debian · 12

[Debian 13 (Trixie)]

[openSUSE Tumbleweed]

Observado:

Referências

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]