Account Takeover In py3-django
Description
insufficient validation
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.11 | =1.10.5-r0 || =1.10.7-r0 || =1.11-r0 || =1.11-r1 || =1.11.10-r0 || =1.11.11-r0 || =1.11.12-r0 || =1.11.13-r0 || =1.11.15-r0 || =1.11.18-r0 || =1.11.20-r0 || =1.11.20-r1 || =1.11.21-r0 || =1.11.22-r0 || =1.11.23-r0 || =1.11.23-r1 || =1.11.23-r2 || =1.11.5-r0 || =1.11.9-r0 || =1.2.5-r0 || =1.2.5-r1 || =1.4.1-r0 || =1.5-r0 || =1.5.1-r0 || =1.5.5-r0 || =1.5.6-r0 || =1.5.7-r0 || =1.5.8-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.7-r0 || =1.8-r0 || =1.8.10-r0 || =1.8.12-r0 || =1.8.14-r0 || =1.8.15-r0 || =1.8.16-r0 || =1.8.3-r0 || =1.8.4-r0 || =1.8.6-r0 || =1.8.7-r0 || =1.8.8-r0 || >=0 <1.11.27-r0 | 1.11.27-r0 | |
alpine v3.12 | =1.10.5-r0 || =1.10.7-r0 || =1.11-r0 || =1.11-r1 || =1.11.10-r0 || =1.11.11-r0 || =1.11.12-r0 || =1.11.13-r0 || =1.11.15-r0 || =1.11.18-r0 || =1.11.20-r0 || =1.11.20-r1 || =1.11.21-r0 || =1.11.22-r0 || =1.11.23-r0 || =1.11.23-r1 || =1.11.23-r2 || =1.11.5-r0 || =1.11.9-r0 || =1.2.5-r0 || =1.2.5-r1 || =1.4.1-r0 || =1.5-r0 || =1.5.1-r0 || =1.5.5-r0 || =1.5.6-r0 || =1.5.7-r0 || =1.5.8-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.7-r0 || =1.8-r0 || =1.8.10-r0 || =1.8.12-r0 || =1.8.14-r0 || =1.8.15-r0 || =1.8.16-r0 || =1.8.3-r0 || =1.8.4-r0 || =1.8.6-r0 || =1.8.7-r0 || =1.8.8-r0 || >=0 <1.11.27-r0 | 1.11.27-r0 | |
 debian 11 | >=0 <2:2.2.9-1 | 2:2.2.9-1 | |
debian 12 | >=0 <2:2.2.9-1 | 2:2.2.9-1 | |
debian 14 | >=0 <2:2.2.9-1 | 2:2.2.9-1 | |
 pypi | >=0 <1.11.27 || >=2.0 <2.2.9 || >=3.0 <3.0.1 | 1.11.27, 2.2.9, 3.0.1 | |
alpine v3.10 | =1.10.5-r0 || =1.10.7-r0 || =1.11-r0 || =1.11-r1 || =1.11.10-r0 || =1.11.11-r0 || =1.11.12-r0 || =1.11.13-r0 || =1.11.15-r0 || =1.11.18-r0 || =1.11.20-r0 || =1.11.20-r1 || =1.11.21-r0 || =1.11.22-r0 || =1.11.23-r0 || =1.11.5-r0 || =1.11.9-r0 || =1.2.5-r0 || =1.2.5-r1 || =1.4.1-r0 || =1.5-r0 || =1.5.1-r0 || =1.5.5-r0 || =1.5.6-r0 || =1.5.7-r0 || =1.5.8-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.7-r0 || =1.8-r0 || =1.8.10-r0 || =1.8.12-r0 || =1.8.14-r0 || =1.8.15-r0 || =1.8.16-r0 || =1.8.3-r0 || =1.8.4-r0 || =1.8.6-r0 || =1.8.7-r0 || =1.8.8-r0 || >=0 <1.11.27-r0 | 1.11.27-r0 | |
alpine v3.9 | =1.10.5-r0 || =1.10.7-r0 || =1.11-r0 || =1.11-r1 || =1.11.10-r0 || =1.11.11-r0 || =1.11.12-r0 || =1.11.13-r0 || =1.11.15-r0 || =1.11.18-r0 || =1.11.20-r0 || =1.11.21-r0 || =1.11.22-r0 || =1.11.23-r0 || =1.11.5-r0 || =1.11.9-r0 || =1.2.5-r0 || =1.2.5-r1 || =1.4.1-r0 || =1.5-r0 || =1.5.1-r0 || =1.5.5-r0 || =1.5.6-r0 || =1.5.7-r0 || =1.5.8-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.7-r0 || =1.8-r0 || =1.8.10-r0 || =1.8.12-r0 || =1.8.14-r0 || =1.8.15-r0 || =1.8.16-r0 || =1.8.3-r0 || =1.8.4-r0 || =1.8.6-r0 || =1.8.7-r0 || =1.8.8-r0 || >=0 <1.11.27-r0 | 1.11.27-r0 | |
debian 13 | >=0 <2:2.2.9-1 | 2:2.2.9-1 | |
alpine v3.8 | =1.10.5-r0 || =1.10.7-r0 || =1.11-r0 || =1.11-r1 || =1.11.10-r0 || =1.11.11-r0 || =1.11.12-r0 || =1.11.13-r0 || =1.11.15-r0 || =1.11.18-r0 || =1.11.20-r0 || =1.11.21-r0 || =1.11.22-r0 || =1.11.23-r0 || =1.11.5-r0 || =1.11.9-r0 || =1.2.5-r0 || =1.2.5-r1 || =1.4.1-r0 || =1.5-r0 || =1.5.1-r0 || =1.5.5-r0 || =1.5.6-r0 || =1.5.7-r0 || =1.5.8-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.7-r0 || =1.8-r0 || =1.8.10-r0 || =1.8.12-r0 || =1.8.14-r0 || =1.8.15-r0 || =1.8.16-r0 || =1.8.3-r0 || =1.8.4-r0 || =1.8.6-r0 || =1.8.7-r0 || =1.8.8-r0 || >=0 <1.11.27-r0 | 1.11.27-r0 |
1-10 of 11
10
Aliases
References
1. https://www.exploit-db.com/exploits/478792. https://github.com/ryu22e/django_cve_2019_19844_poc3. https://github.com/django/django/commit/302a4ff1e8b1c798aab97673909c7a3dfda42c264. https://github.com/django/django/commit/4d334bea06cac63dc1272abcec545b85136cca0e5. https://github.com/django/django/commit/5b1fbcef7a8bec991ebe7b2a18b5d5a95d72cb706. https://github.com/django/django/commit/f4cff43bf921fcea6a29b726eb66767f67753fa27. https://www.djangoproject.com/weblog/2019/dec/18/security-releases8. https://www.debian.org/security/2020/dsa-45989. https://usn.ubuntu.com/4224-110. https://security.netapp.com/advisory/ntap-20200110-000311. https://seclists.org/bugtraq/2020/Jan/912. https://lists.fedoraproject.org/archives/list/[email protected]/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD13. https://groups.google.com/forum/#!topic/django-announce/3oaB2rVH3a014. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-16.yaml15. https://docs.djangoproject.com/en/dev/releases/security16. http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.