LiveActive security incident?Get immediate response
CVE Record

CVE-2023-24329: An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting meth...

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Python's URL parser could treat URLs starting with blank characters differently than security checks expected. Applications that block dangerous URL schemes or destinations could make the wrong decision, allowing an otherwise blocked URL path. The business risk is policy bypass in services that trust Python URL parsing for user-supplied URLs.

Executive priority

Prioritize remediation for internet-facing Python services that enforce URL restrictions. This is less urgent than a confirmed exploited remote-code-execution issue, but policy bypass can undermine controls around redirects, outbound requests, or destination blocking.

Technical view

CVE-2023-24329 is an input-validation flaw in Python urllib.parse before 3.11.4. Leading blank characters in a URL can bypass blocklisting logic built on parsed URL components. The CVSS vector rates integrity impact high, with network attackability and no privileges or user interaction required.

Likely exposure

Exposure is most likely in Python applications that accept untrusted URLs and use urllib.parse for blocklists, scheme validation, redirects, outbound fetch controls, or similar policy decisions. Distro-packaged Python and vendor appliances may have separate advisories and backports.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. Public issue and fix references indicate the behavior was known and patch work existed, but the provided evidence does not support claiming exploitation in the wild.

Researcher notes

Treat affectedness as application-context dependent. The CVE record lists urllib.parse before 3.11.4, while distribution advisories may fix older branches through backports. Validate both runtime version and actual URL-validation behavior rather than relying only on version strings.

Mitigation direction

  • Upgrade Python to vendor-fixed releases, including 3.11.4 or applicable backports.
  • Apply operating-system package updates from Fedora or other trusted vendor advisories.
  • Review vendor guidance for NetApp or other products embedding Python.
  • Reject or normalize leading blank/control characters before URL policy checks.
  • Prefer allowlists for permitted schemes and destinations over blocklists.

Validation and detection

  • Inventory services that parse user-supplied URLs with Python urllib.parse.
  • Identify Python versions and vendor package backport status.
  • Review URL security checks for dependence on parsed scheme or hostname.
  • Add regression tests for leading blank-character URL handling.
  • Confirm updated runtimes preserve expected URL-blocking behavior.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-24329 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
30Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2023-24329Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-20 · source CWE mapping

Improper Input Validation

Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs