Information Disclosure

django is vulnerable to information disclosure. Admin users with the view-only permission are able to retrieve the entire password hash of arbitrary accounts through the read-only password widget that displays obfuscated password hashes...