CVEvulnerability

CVE-2019-19844

9.8 CRITICAL Published 2019-12-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-12-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-640

Description

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Affected configurations

• djangoproject django (< 1.11.27) • djangoproject django (>= 2.2 < 2.2.9) • djangoproject django 3.0 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.04 • canonical ubuntu linux 19.10

Related

Weakness · CWE (1)

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References