5.3 CVE-2024-45231
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
https://nvd.nist.gov/vuln/detail/CVE-2024-45231
Categories
CWE-NVD-noinfo
CWE-203 : Observable Discrepancy
Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
References
cve@mitre.org
| https://docs.djangoproject.com/en/dev/releases/security/ Vendor Advisory |
| https://groups.google.com/forum/#%21forum/django-announce Permissions Required |
| https://www.djangoproject.com/weblog/2024/sep/03/security-releases/ Vendor Advisory |
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | >= 4.2.0 | < 4.2.16 |
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | >= 5.0 | < 5.0.9 |
| cpe:2.3:a:djangoproject:django:5.1:*:*:*:*:*:*:* | ||
REMEDIATION
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| 189 | Black Box Reverse Engineering |
Low |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
