Vulnetix
Try Vulnetix Request Demo
CVE-2024-45231 PUBLISHED

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

EPSS 0.23% · 46.2th percentile

Risk Scores

EPSS Score
0.23%
46.2th percentile

Affected Products

VendorProductVersions
Bitnamidjango4.2.0, 5.0.0, 5.1.0
Bitnamidjango4.2.0, 5.0.0, 5.1.0

Timeline

References

Open in Interactive Console →