CVE-2024-45231

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

Fixed

6f9fea33137fee6416ff43b775aa9567440a23d3

Introduced

52821001bb62b764d73e63812133f199b8fef9eb

Fixed

8e68f938f376cf2ca22a7e8ff0bcbe1b7a5832d1

Introduced

Last affected

84d09a547fe35e10018ab242602ca76c29ca91a1

Database specific

{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.16"
        },
        {
            "introduced": "5.0"
        },
        {
            "fixed": "5.0.9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.1"
        }
    ]
}

Affected versions

1.*

1.0

1.0.1

1.0.2

1.0.3

1.0.4

1.1

1.1.1

1.1.2

1.1.3

1.1.4

1.10

1.10.1

1.10.2

1.10.3

1.10.4

1.10.5

1.10.6

1.10.7

1.10.8

1.10a1

1.10b1

1.10rc1

1.11

1.11.1

1.11.10

1.11.11

1.11.12

1.11.13

1.11.14

1.11.15

1.11.16

1.11.17

1.11.18

1.11.19

1.11.2

1.11.20

1.11.21

1.11.22

1.11.23

1.11.24

1.11.25

1.11.26

1.11.27

1.11.28

1.11.29

1.11.3

1.11.4

1.11.5

1.11.6

1.11.7

1.11.8

1.11.9

1.11a1

1.11b1

1.11rc1

1.2

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.3

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4

1.4.1

1.4.10

1.4.11

1.4.12

1.4.13

1.4.14

1.4.15

1.4.16

1.4.17

1.4.18

1.4.19

1.4.2

1.4.20

1.4.21

1.4.22

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5

1.5.1

1.5.10

1.5.11

1.5.12

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.5a1

1.5b1

1.5b2

1.5c1

1.5c2

1.6

1.6.1

1.6.10

1.6.11

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.6a1

1.6b1

1.6b2

1.6b3

1.6b4

1.6c1

1.7

1.7.1

1.7.10

1.7.11

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7a1

1.7a2

1.7b1

1.7b2

1.7b3

1.7b4

1.7c1

1.7c2

1.7c3

1.8

1.8.1

1.8.10

1.8.11

1.8.12

1.8.13

1.8.14

1.8.15

1.8.16

1.8.17

1.8.18

1.8.19

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.8a1

1.8b1

1.8b2

1.8c1

1.9

1.9.1

1.9.10

1.9.11

1.9.12

1.9.13

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

1.9a1

1.9b1

1.9rc1

1.9rc2

2.*

2.0

2.0.1

2.0.10

2.0.11

2.0.12

2.0.13

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0a1

2.0b1

2.0rc1

2.1

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1a1

2.1b1

2.1rc1

2.2

2.2.1

2.2.10

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

2.2.18

2.2.19

2.2.2

2.2.20

2.2.21

2.2.22

2.2.23

2.2.24

2.2.25

2.2.26

2.2.27

2.2.28

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2a1

2.2b1

2.2rc1

3.*

3.0

3.0.1

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0a1

3.0b1

3.0rc1

3.1

3.1.1

3.1.10

3.1.11

3.1.12

3.1.13

3.1.14

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.1a1

3.1b1

3.1rc1

3.2

3.2.1

3.2.10

3.2.11

3.2.12

3.2.13

3.2.14

3.2.15

3.2.16

3.2.17

3.2.18

3.2.19

3.2.2

3.2.20

3.2.21

3.2.22

3.2.23

3.2.24

3.2.25

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.2.9

3.2a1

3.2b1

3.2rc1

4.*

4.0

4.0.1

4.0.10

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.0a1

4.0b1

4.0rc1

4.1

4.1.1

4.1.10

4.1.11

4.1.12

4.1.13

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.1.7

4.1.8

4.1.9

4.1a1

4.1b1

4.1rc1

4.2

4.2.1

4.2.10

4.2.11

4.2.12

4.2.13

4.2.14

4.2.15

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.2.8

4.2.9

4.2a1

4.2b1

4.2rc1

5.*

5.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0a1

5.0b1

5.0rc1

5.1

5.1.1

5.1.10

5.1.11

5.1.12

5.1.13

5.1.14

5.1.15

5.1.2

5.1.3

5.1.4

5.1.5

5.1.6

5.1.7

5.1.8

5.1.9

5.1a1

5.1b1

5.1rc1

5.2

5.2.1

5.2.10

5.2.11

5.2.12

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.2a1

5.2b1

5.2rc1

6.*

6.0

6.0.1

6.0.2

6.0.3

6.0a1

6.0b1

6.0rc1

Other

archive/attic/boulder-oracle-sprint

archive/attic/full-history

archive/attic/generic-auth

archive/attic/gis

archive/attic/i18n

archive/attic/magic-removal

archive/attic/multi-auth

archive/attic/multiple-db-support

archive/attic/new-admin

archive/attic/newforms-admin

archive/attic/per-object-permissions

archive/attic/queryset-refactor

archive/attic/schema-evolution

archive/attic/schema-evolution-ng

archive/attic/search-api

archive/attic/sqlalchemy

archive/attic/unicode

archive/soc2009/admin-ui

archive/soc2009/http-wsgi-improvements

archive/soc2009/i18n-improvements

archive/soc2009/model-validation

archive/soc2009/multidb

archive/soc2009/test-improvements

archive/soc2010/app-loading

archive/soc2010/query-refactor

archive/soc2010/test-refactor

stable/0.*

stable/0.90.x

stable/0.91.x

stable/0.95.x

stable/0.96.x

stable/1.*

stable/1.0.x

stable/1.1.x

stable/1.10.x

stable/1.11.x

stable/1.2.x

stable/1.3.x

stable/1.4.x

stable/1.5.x

stable/1.6.x

stable/1.7.x

stable/1.8.x

stable/1.9.x

stable/2.*

stable/2.0.x

stable/2.1.x

stable/2.2.x

stable/3.*

stable/3.0.x

stable/3.1.x

stable/3.2.x

stable/4.*

stable/4.0.x

stable/4.1.x

stable/5.*

stable/5.0.x

stable/5.1.x

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45231.json"