#VU23667 Input validation error in Django - CVE-2019-19844
Published: December 18, 2019 / Updated: June 17, 2021
Vulnerability identifier: #VU23667
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2019-19844
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Django
Django
Software vendor:
Django Software Foundation
Django Software Foundation
Description
The vulnerability allows a remote attacker to hijack another user account.
The vulnerability exists due to insufficient validation of user-supplied input when processing email addresses passed via the password reset form. A remote attacker with knowledge of a valid email address can use a specially crafted email that after Unicode transformation will be treated as the victim's email address and reset password for the victim's account to the attacker provided email address.
Remediation
Install updates from vendor's website.