Test ID:	1.3.6.1.4.1.25623.1.0.112678
Category:	Web application abuses
Title:	Django Account Hijacking Vulnerability - Linux
Summary:	Django is prone to an account hijacking vulnerability.
Description:	Summary: Django is prone to an account hijacking vulnerability. Vulnerability Insight: Django's password-reset form uses a case-insensitive query to retrieve accounts matching the email address requesting the password reset. Because this typically involves explicit or implicit case transformations, an attacker who knows the email address associated with a user account can craft an email address which is distinct from the address associated with that account, but which -- due to the behavior of Unicode case transformations -- ceases to be distinct after case transformation, or which will otherwise compare equal given database case-transformation or collation behavior. Vulnerability Impact: By successfully exploiting this issue an attacker can receive a valid password-reset token for the user account. Affected Software/OS: All Django versions before 1.11.2, 2.x before 2.2.9 and 3.x before 3.0.1. Solution: Update to version 1.11.2, 2.2.9 or 3.0.1 respectively. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-19844 Bugtraq: 20200108 [SECURITY] [DSA 4598-1] python-django security update (Google Search) https://seclists.org/bugtraq/2020/Jan/9 Debian Security Information: DSA-4598 (Google Search) https://www.debian.org/security/2020/dsa-4598 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/ https://security.gentoo.org/glsa/202004-17 http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html https://docs.djangoproject.com/en/dev/releases/security/ https://groups.google.com/forum/#!topic/django-announce/3oaB2rVH3a0 https://usn.ubuntu.com/4224-1/
Copyright	Copyright (C) 2019 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.