GitHub Advisoryadvisory · PyPI

GHSA-vfq6-hq5r-27r6 Django Potential account hijack via password reset form

CRITICAL Published 2020-01-16 Modified 2024-09-20 Official page ↗
Aliases
CVE-2019-19844
Ecosystem
PyPI
Packages
Django
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-640
Reviewed
2020-01-16

Affected packages

• PyPI Django: < 1.11.27 → fixed in 1.11.27 • PyPI Django: >= 2.0, < 2.2.9 → fixed in 2.2.9 • PyPI Django: >= 3.0, < 3.0.1 → fixed in 3.0.1

Description

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Related

Alias · CVE (1)

  • CVE-2019-19844 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. vulnerability

Weakness · CWE (1)

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References