CVE-2019-19844
18.12.2019, 19:15
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)Enginsight
| Vendor | Product | Version |
|---|---|---|
| djangoproject | django | 𝑥 < 1.11.27 |
| djangoproject | django | 2.2 ≤ 𝑥 < 2.2.9 |
| djangoproject | django | 3.0 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.04 |
| canonical | ubuntu_linux | 19.10 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| python-django |
|
Common Weakness Enumeration
References