USN-6722-1: Django vulnerability

🗓️ 08 Apr 2024 11:14:30Reported by UbuntuType

Django vulnerability in Ubuntu 14.04 ESM, python-django package allows attackers to obtain password reset tokens and hijack accounts using Unicode case insensitive query

Reporter	Title	Published	Views	Family All 155
0day.today	Django < 3.0 < 2.2 < 1.11 - Account Hijack Vulnerability	24 Dec 201900:00	–	zdt
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	8 Dec 202020:38	–	gitee
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	21 Dec 201904:30	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	18 Jan 202013:32	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	25 Dec 201910:05	–	githubexploit
AlpineLinux	CVE-2019-19844	18 Dec 201918:07	–	alpinelinux
ALT Linux	Security fix for the ALT Linux 10 package python3-module-django version 2.2.12-alt1	12 Apr 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package python3-module-django version 2.2.12-alt1	12 Apr 202000:00	–	altlinux
Circl	CVE-2019-19844	24 Dec 201900:00	–	circl
CNVD	Django Account Hijacking Vulnerability	19 Dec 201900:00	–	cnvd

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	14.04	any	python-django	1.6.11-0ubuntu1.3+esm7	python-django_1.6.11-0ubuntu1.3+esm7_any.deb
Ubuntu	14.04	any	python-django-doc	1.6.11-0ubuntu1.3+esm7	python-django-doc_1.6.11-0ubuntu1.3+esm7_any.deb

08 Apr 2024 11:14Current

7.1High risk

Vulners AI Score7.1

CVSS 25

CVSS 3.19.8

EPSS0.15418