Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2019-19844 — Weak Password Recovery Mechanism for Forgotten Password in Django
Severity
9.8CRITICALNVD
EPSS
14.0%
top 5.65%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedDec 18
Latest updateApr 8
Description
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages2 packages
Also affects: Ubuntu Linux 16.04, 18.04, 19.04, 19.10
🔴Vulnerability Details
4💥Exploits & PoCs
1📋Vendor Advisories
3💬Community
6Bugzilla▶
CVE-2019-19844 python-django: Django: crafted email address allows account takeover [openstack-rdo]↗2020-01-08
Bugzilla▶
CVE-2019-19844 python-django16: Django: crafted email address allows account takeover [epel-7]↗2020-01-07
Bugzilla▶
CVE-2019-19844 python-django: Django: crafted email address allows account takeover [epel-8]↗2020-01-07
Bugzilla▶
CVE-2019-19844 python-django: Django: crafted email address allows account takeover [epel-7]↗2020-01-07