Description

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

Remediation

References

CVE-2021-44420

Related Vulnerabilities

Oracle JRE Improper Access Control Vulnerability (CVE-2025-30698)

Apache Tomcat Improper Resource Shutdown or Release Vulnerability (CVE-2022-25762)

Lighttpd Other Vulnerability (CVE-2007-1869)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2741)

SharePoint CVE-2021-26420 Vulnerability (CVE-2021-26420)

Severity

High

Classification

CVE-2021-44420 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities