CVE-2019-19844

Published: Dec 18, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Affected (7)

Products: Djangoproject: Django · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	Before 1.11.27
Djangoproject Django	From 2.2 to 2.2.9
Djangoproject Django	Version 3.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04
Canonical Ubuntu Linux	Version 19.10

Related CWEs

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (20)

http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html

Source: cve@mitre.org

https://docs.djangoproject.com/en/dev/releases/security/

Source: cve@mitre.org

Vendor Advisory

https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/

Source: cve@mitre.org

https://seclists.org/bugtraq/2020/Jan/9

Source: cve@mitre.org

https://security.gentoo.org/glsa/202004-17

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20200110-0003/

Source: cve@mitre.org

https://usn.ubuntu.com/4224-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4598

Source: cve@mitre.org

https://www.djangoproject.com/weblog/2019/dec/18/security-releases/

Source: cve@mitre.org

Vendor Advisory

http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.djangoproject.com/en/dev/releases/security/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2020/Jan/9

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202004-17

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20200110-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/4224-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4598

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.djangoproject.com/weblog/2019/dec/18/security-releases/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.