Sensitive Data Exposure in django-registration Package
Summary
CVE-2021-21416: django-registration is a user registration package for Django. Affects python-django-registration versions < 2db0bb7ec35636ea46b07b146328b87b2cb13ca5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-registration is a user registration package designed for the Django web framework, facilitating user-account registration flows. It offers features like customizable registration forms, email verification, and password reset functionalities. However, prior to version 3.1.2, it had a critical vulnerability that could expose sensitive user data during error reporting.
Vulnerability Detail
The vulnerability arises from the base user-account registration view in django-registration, which failed to apply necessary filters to sensitive data. This oversight means that if a server-side error (HTTP 5xx) occurs during a user registration attempt, detailed error reports sent to site staff or developers could inadvertently include sensitive information such as passwords. This poses a significant risk, as it could lead to unauthorized access if such data is exposed to unintended recipients.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can disable detailed error reporting in your Django settings by setting DEBUG = False in your settings.py file. This will prevent sensitive data from being included in error reports until the package can be updated.
Conclusion
The django-registration package has a vulnerability that could expose sensitive user data through detailed error reports. Upgrading to version 3.1.2 or later is essential to mitigate this risk. Additionally, disabling detailed error reporting can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for python-django-registration →
FAQ
All versions prior to 3.1.2 are affected by this vulnerability.
Sensitive data such as user passwords and other registration details could be included in error reports.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 2.6, indicating a low severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python-django-registration.
