CVE-2024-45231 - Medium Severity Vulnerability
Vulnerable Libraries - Django-3.2.19-py3-none-any.whl, Django-3.2.14-py3-none-any.whl
Django-3.2.19-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/22/af/979a4c610e727cc936c3db3d48cfcb3c270e106ff919f23fc1a27870ba00/Django-3.2.19-py3-none-any.whl
Sample Path to Dependency File: /tmp/ws-scm/django-model-subscription
Path to vulnerable library: /tmp/ws-scm/django-model-subscription
Dependency Hierarchy:
- ❌ Django-3.2.19-py3-none-any.whl (Vulnerable Library)
Django-3.2.14-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/c0/a8/4afc7742ad1e506909ce8c5056761f22c8a2db0a8b4a46cfa290b1cd6685/Django-3.2.14-py3-none-any.whl
Dependency Hierarchy:
- ❌ Django-3.2.14-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
Publish Date: 2024-10-08
URL: CVE-2024-45231
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-rrqc-c2jx-6jgv
Release Date: 2024-10-08
Fix Resolution: django - 5.0.9,django - 4.2.16,django - 5.1.1,django - 5.1.1,django - 4.2.16
Step up your Open Source Security Game with Mend here
CVE-2024-45231 - Medium Severity Vulnerability
Django-3.2.19-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/22/af/979a4c610e727cc936c3db3d48cfcb3c270e106ff919f23fc1a27870ba00/Django-3.2.19-py3-none-any.whl
Sample Path to Dependency File: /tmp/ws-scm/django-model-subscription
Path to vulnerable library: /tmp/ws-scm/django-model-subscription
Dependency Hierarchy:
Django-3.2.14-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/c0/a8/4afc7742ad1e506909ce8c5056761f22c8a2db0a8b4a46cfa290b1cd6685/Django-3.2.14-py3-none-any.whl
Dependency Hierarchy:
Found in base branch: main
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
Publish Date: 2024-10-08
URL: CVE-2024-45231
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: GHSA-rrqc-c2jx-6jgv
Release Date: 2024-10-08
Fix Resolution: django - 5.0.9,django - 4.2.16,django - 5.1.1,django - 5.1.1,django - 4.2.16
Step up your Open Source Security Game with Mend here