CVE-2018-6188
- Source
- https://cve.org/CVERecord?id=CVE-2018-6188
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6188.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-6188
- Aliases
- Downstream
- Related
- Published
- 2018-02-05T03:29:00.267Z
- Modified
- 2026-07-15T10:14:48.149789625Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirmloginallowed() method, as demonstrated by discovering whether a user account is inactive.
- Database specific
{ "unresolved_ranges": [ { "source": "CPE_STRING", "cpes": [ "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*" ], "vendor_product": "canonical:ubuntu_linux", "extracted_events": [ { "introduced": "17.10" }, { "last_affected": "17.10" } ] } ] }- References
Affected packages
Git / github.com/django/django
Affected ranges
- Type
- GIT
- Repo
- https://github.com/django/django
- Events
-
IntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:djangoproject:django:1.11.8:*:*:*:*:*:*:*", "cpe:2.3:a:djangoproject:django:1.11.9:*:*:*:*:*:*:*", "cpe:2.3:a:djangoproject:django:2.0:*:*:*:*:*:*:*", "cpe:2.3:a:djangoproject:django:2.0.1:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "1.11.8" }, { "last_affected": "1.11.8" }, { "introduced": "1.11.9" }, { "last_affected": "1.11.9" }, { "introduced": "2.0" }, { "last_affected": "2.0" }, { "introduced": "2.0.1" }, { "last_affected": "2.0.1" } ] }