CVE-2019-19844

🗓️ 18 Dec 2019 18:07:11Reported by mitreType

cve🔗 web.nvd.nist.gov👁 274 Views🌐 WEB

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover

Reporter	Title	Published	Views	Family All 111
0day.today	Django < 3.0 < 2.2 < 1.11 - Account Hijack Vulnerability	24 Dec 201900:00	–	zdt
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	8 Dec 202020:38	–	gitee
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	21 Dec 201904:30	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	18 Jan 202013:32	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	25 Dec 201910:05	–	githubexploit
AlpineLinux	CVE-2019-19844	18 Dec 201918:07	–	alpinelinux
BDU FSTEC	The vulnerability of the Django web application framework, related to a bug in the password restoration mechanism, allows attackers to compromise data integrity.	14 Apr 202000:00	–	bdu_fstec
ALT Linux	Security fix for the ALT Linux 10 package python3-module-django version 2.2.12-alt1	12 Apr 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package python3-module-django version 2.2.12-alt1	12 Apr 202000:00	–	altlinux
Circl	CVE-2019-19844	24 Dec 201900:00	–	circl

NVD

Node

Node

Source	Link
seclists	www.seclists.org/bugtraq/2020/Jan/9
usn	www.usn.ubuntu.com/4224-1/
djangoproject	www.djangoproject.com/weblog/2019/dec/18/security-releases/
security	www.security.gentoo.org/glsa/202004-17
debian	www.debian.org/security/2020/dsa-4598
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/
groups	www.groups.google.com/forum/
packetstormsecurity	www.packetstormsecurity.com/files/155872/Django-Account-Hijack.html
security	www.security.netapp.com/advisory/ntap-20200110-0003/
docs	www.docs.djangoproject.com/en/dev/releases/security/

Parameter	Position	Path	Description	CWE
email	request body	accounts/password-reset/	Password reset flow can target an existing account by sending a reset token to an attacker-controlled email due to Unicode case handling in email matching.	CWE-640

17 Jun 2026 02:27Current

9.2High risk

Vulners AI Score9.2

CVSS 25

CVSS 3.19.8

EPSS0.3481