Vulnetix
Try Vulnetix Request Demo
CVE-2019-19844 PUBLISHED

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

EPSS 13.97% · 94.3th percentile

Risk Scores

EPSS Score
13.97%
94.3th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:14.04:LTSpython-django1.6.1-2ubuntu0.14, 1.6.1-2ubuntu0.15, 1.6.1-2ubuntu0.16
Ubuntu:18.04:LTSpython-django1:1.11.11-1ubuntu1.3, 1:1.11.4-1ubuntu1, 1:1.11.6-1ubuntu1
Ubuntu:20.04:LTSpython-django2:2.2.6-1ubuntu1, 1:1.11.22-1ubuntu1, 0
Ubuntu:16.04:LTSpython-django0, 1.7.9-1ubuntu5, 1.8.5-2ubuntu1

Timeline

References

Open in Interactive Console →