CVE-2019-19844

🗓️ 18 Dec 2019 19:15:11Reported by [email protected]Type

Django versions before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allow account takeover via crafted email address case transformation. Mitigation includes sending password reset tokens to the registered user email address

Reporter	Title	Published	Views	Family All 111
zdt	Django < 3.0 < 2.2 < 1.11 - Account Hijack Vulnerability	24 Dec 201900:00	–	zdt
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	8 Dec 202020:38	–	gitee
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	21 Dec 201904:30	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	18 Jan 202013:32	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	25 Dec 201910:05	–	githubexploit
AlpineLinux	CVE-2019-19844	18 Dec 201918:07	–	alpinelinux
BDU FSTEC	The vulnerability of the Django web application framework, related to a bug in the password restoration mechanism, allows attackers to compromise data integrity.	14 Apr 202000:00	–	bdu_fstec
ALT Linux	Security fix for the ALT Linux 10 package python3-module-django version 2.2.12-alt1	12 Apr 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package python3-module-django version 2.2.12-alt1	12 Apr 202000:00	–	altlinux
Circl	CVE-2019-19844	24 Dec 201900:00	–	circl

NVD

Node

djangoproject djangoRange<1.11.27

djangoproject djangoRange2.2–2.2.9

djangoproject djangoMatch3.0

Node

canonical ubuntu_linuxMatch16.04lts

canonical ubuntu_linuxMatch18.04lts

canonical ubuntu_linuxMatch19.04

canonical ubuntu_linuxMatch19.10

Source	Link
groups	www.groups.google.com/forum/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/
security	www.security.netapp.com/advisory/ntap-20200110-0003/
docs	www.docs.djangoproject.com/en/dev/releases/security/
usn	www.usn.ubuntu.com/4224-1/
debian	www.debian.org/security/2020/dsa-4598
security	www.security.gentoo.org/glsa/202004-17
packetstormsecurity	www.packetstormsecurity.com/files/155872/Django-Account-Hijack.html
seclists	www.seclists.org/bugtraq/2020/Jan/9
djangoproject	www.djangoproject.com/weblog/2019/dec/18/security-releases/

17 Jun 2026 02:27Current

9.4High risk

Vulners AI Score9.4

CVSS 25

CVSS 3.19.8

EPSS0.35052

CWE-640