User Enumeration Vulnerability in Python-Django: CVE-2024-39329
Summary
UBUNTU-CVE-2024-39329: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and an admin interface. However, certain versions of Django are vulnerable to a timing attack that can allow remote attackers to enumerate user accounts with unusable passwords.
Vulnerability Detail
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. This vulnerability can lead to unauthorized access attempts and compromise user account security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider disabling the authentication method that allows for user enumeration or implementing rate limiting on login attempts to mitigate the risk of timing attacks.
Conclusion
CVE-2024-39329 is a significant vulnerability in Python-Django that can lead to user enumeration through timing attacks. It is crucial for users of affected versions to update their packages to the latest patched versions to ensure security. Additionally, implementing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-39329 is a vulnerability in certain versions of Python-Django that allows remote attackers to enumerate user accounts through a timing attack.
The vulnerability affects Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14.
Attackers can exploit this vulnerability to determine valid user accounts, potentially leading to unauthorized access attempts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
The CVSS score for CVE-2024-39329 is 5.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
