Input validation error in Django - CVE-2019-19844
Published: December 18, 2019 / Updated: June 17, 2021
Vulnerability identifier: #VU23667
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2019-19844
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: Django Software Foundation
Affected software:
Django
Django
Detailed vulnerability description
The vulnerability allows a remote attacker to hijack another user account.
The vulnerability exists due to insufficient validation of user-supplied input when processing email addresses passed via the password reset form. A remote attacker with knowledge of a valid email address can use a specially crafted email that after Unicode transformation will be treated as the victim's email address and reset password for the victim's account to the attacker provided email address.
How to mitigate CVE-2019-19844
Install updates from vendor's website.