Fluid Attacks Database

Description

Django allows enumeration of user e-mail addresses An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	python-django	=3:3.2.19-1 \|\| =3:3.2.19-1+deb12u1 \|\| =3:3.2.19-1+deb12u1~bpo11+1 \|\| =3:3.2.19-1+deb12u2 \|\| =3:3.2.20-1 \|\| =3:3.2.20-1.1 \|\| =3:3.2.21-1 \|\| >=0 <3:3.2.25-0+deb12u1	3:3.2.25-0+deb12u1
pypi	django	>=5.1 <5.1.1 \|\| >=5.0 <5.0.9 \|\| >=0 <4.2.16	5.1.1, 5.0.9, 4.2.16
debian 11	python-django	=2:2.2.24-1 \|\| =2:2.2.25-1~deb11u1 \|\| =2:2.2.26-1~deb11u1 \|\| =2:2.2.28-1~deb11u1 \|\| =2:2.2.28-1~deb11u10 \|\| =2:2.2.28-1~deb11u2 \|\| =2:2.2.28-1~deb11u3 \|\| =2:2.2.28-1~deb11u4 \|\| =2:2.2.28-1~deb11u5 \|\| =2:2.2.28-1~deb11u6 \|\| =2:2.2.28-1~deb11u7 \|\| =2:2.2.28-1~deb11u8 \|\| =2:2.2.28-1~deb11u9 \|\| >=0 <2:2.2.28-1~deb11u11	2:2.2.28-1~deb11u11
debian 13	python-django	>=0 <3:4.2.16-1	3:4.2.16-1
debian 14	python-django	>=0 <3:4.2.16-1	3:4.2.16-1

Aliases

1. CVE-2024-452312. NVD-2024-452313. OSV-DEBIAN-2024-452314. OSV-2024-452315. GCVE-2024-452316. SECURITY-TRACKER-CVE-2024-45231

References

1. https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca2. https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e23. https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc7311994. https://docs.djangoproject.com/en/dev/releases/security5. https://groups.google.com/forum/#%21forum/django-announce6. https://www.djangoproject.com/weblog/2024/sep/03/security-releases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.