CVE-2010-4535: Input Validation
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4535?
CVE-2010-4535 has a medium severity rating due to its potential for denial of service through resource consumption.
How do I fix CVE-2010-4535?
To fix CVE-2010-4535, upgrade to Django version 1.2.4 or later, or to 1.1.3 or later.
What versions are affected by CVE-2010-4535?
CVE-2010-4535 affects Django versions prior to 1.1.3, 1.2.4, and 1.3 beta 1.
What type of vulnerability is CVE-2010-4535?
CVE-2010-4535 is a denial of service vulnerability related to password reset functionality.
Who can exploit CVE-2010-4535?
Remote attackers can exploit CVE-2010-4535 by sending specially crafted URLs to trigger the vulnerability.