CVE-2024-45231

Name
CVE-2024-45231
Description
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/forum/#%21forum/django-announce
https://www.djangoproject.com/weblog/2024/sep/03/security-releases/

Match rules

CPE URI Source package Min version Max version
n/a == n/a == n/a

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
py3-django edge-community 4.2.16-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
py3-django 3.20-community 4.2.16-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
py3-django 3.21-community 4.2.16-r0 Natanael Copa <ncopa@alpinelinux.org> fixed