SB2019121815 - Arbitrary account hijacking in Django

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019121815

SB2019121815 - Arbitrary account hijacking in Django

Published: December 18, 2019

Security Bulletin ID SB2019121815
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Input validation error (CVE-ID: CVE-2019-19844)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber


The vulnerability allows a remote attacker to hijack another user account.

The vulnerability exists due to insufficient validation of user-supplied input when processing email addresses passed via the password reset form. A remote attacker with knowledge of a valid email address can use a specially crafted email that after Unicode transformation will be treated as the victim's email address and reset password for the victim's account to the attacker provided email address.


Remediation

Install update from vendor's website.

References