CVE-2019-19844: Critical severity djangoproject Django vulnerability
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-19844.
What is the severity of CVE-2019-19844?
The severity of CVE-2019-19844 is critical with a CVSS score of 9.8.
What is the affected software for CVE-2019-19844?
The affected software for CVE-2019-19844 is Django versions before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1.
How does CVE-2019-19844 allow an account takeover?
CVE-2019-19844 allows an account takeover by using a suitably crafted email address that matches an existing user's email address after case transformation of Unicode characters, allowing the attacker to receive a password reset token for the matched user.
Is there a fix available for CVE-2019-19844?
Yes, the fix for CVE-2019-19844 is to upgrade Django to version 1.11.27, 2.2.9, or 3.0.1, depending on the version you are using.