VDB
CVE-2018-6188
CVE-2018-6188
PUBLISHED
Reported by mitre · Published February 5, 2018
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | n/a |
| alpine | py-django | 0, 0, 0 |
| alpine | py3-django | 0, 0, 0 |
Timeline
- Feb 5, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 11, 2023 EPSS Score
References
- USN-3559-1 vendor-advisoryx_refsource_UBUNTU
- 1040422 vdb-entryx_refsource_SECTRACK
- x_refsource_CONFIRM