BIT-django-2024-45231

vendorUSosv

view advisory published 2024-10-19Licence: per source

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-45231US	medium5.3	0.79% (56th)	—	2024-10-08
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows…

references

External citations — patches, advisories, analysis.

https://docs.djangoproject.com/en/dev/releases/security/ADVISORY
https://groups.google.com/forum/#%21forum/django-announceWEB
https://nvd.nist.gov/vuln/detail/CVE-2024-45231WEB
https://www.djangoproject.com/weblog/2024/sep/03/security-releases/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan