VYPR
← All advisories
Critical severityNVD Advisory· Published Dec 18, 2019· Updated Aug 5, 2024

CVE-2019-19844

CVE-2019-19844

Description

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
DjangoPyPI
< 1.11.271.11.27
DjangoPyPI
>= 2.0, < 2.2.92.2.9
DjangoPyPI
>= 3.0, < 3.0.13.0.1

Affected products

270

Patches

Vulnerability mechanics

References

23

News mentions

0

No linked articles in our index yet.