CVE-2024-45231 — Observable Discrepancy in Django

CWE-203 — Observable DiscrepancyCWE-204 — Observable Response Discrepancy9 documents7 sources
Severity
5.3MEDIUMNVD
OSV7.5
EPSS
0.2%
top 53.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Djangoproject Django
Timeline
PublishedOct 8

Description

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDdjangoproject/django4.2.0 — 4.2.16+2
▶PyPIdjangoproject/django5.1 — 5.1.1+2

🔴Vulnerability Details

5
OSV
CVE-2024-45231: An issue was discovered in Django v5↗2024-10-08
▶
OSV
Django allows enumeration of user e-mail addresses↗2024-10-08
▶
CVEList
CVE-2024-45231: An issue was discovered in Django v5↗2024-10-08
▶
GHSA
Django allows enumeration of user e-mail addresses↗2024-10-08
▶
OSV
python-django vulnerabilities↗2024-09-03
▶

📋Vendor Advisories

3
Ubuntu
Django vulnerabilities↗2024-09-03
▶
Red Hat
python-django: Potential user email enumeration via response status on password reset↗2024-09-03
▶
Debian
CVE-2024-45231: python-django - An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contri...↗2024
▶
CVE-2024-45231 — Observable Discrepancy in Django | cvebase