Email Enumeration Vulnerability in Python-Django Package
Summary
UBUNTU-CVE-2024-45231: An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an authentication system. However, certain versions of Python-Django are vulnerable to an email enumeration issue that can be exploited by attackers.
Vulnerability Detail
An issue was discovered in Django versions 5.1.1, 5.0.9, and 4.2.16. The vulnerability lies in the PasswordResetForm class within the django.contrib.auth.forms module. When this form is used in a password reset view, it allows remote attackers to enumerate user email addresses by sending password reset requests and observing the responses. If email sending consistently fails, attackers can infer which email addresses are registered, leading to potential account compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on password reset requests to mitigate the risk of enumeration attacks. Additionally, you can modify the response messages to be more generic, avoiding any indication of whether an email is registered.
Conclusion
The email enumeration vulnerability in the Python-Django package poses a significant risk to user privacy and security. It is crucial for developers and system administrators to update their installations to the latest patched versions to mitigate this risk. Implementing additional security measures, such as rate limiting and generic response messages, can further enhance protection against potential attacks.
See every vulnerability recorded for python-django →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium level of severity.
The affected versions include Django 5.1.1, 5.0.9, and 4.2.16.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Attackers can exploit this vulnerability to enumerate registered email addresses, which could lead to targeted phishing attacks or unauthorized access attempts.
No subscription is required to access the patched version of Python-Django for Ubuntu users.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
