CVE-2024-45231
Fixed in a distro release EPSS <1%CVSS 5.3
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 5.1.1 |
| PyPI | django | 5.0.9 |
| PyPI | django | 4.2.16 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | python-django | 2:2.2.28-1~deb11u11 |
| Debian 12 | python-django | 3:3.2.25-0+deb12u1 |
| Debian 13 | python-django | 3:4.2.16-1 |
| Debian 14 | python-django | 3:4.2.16-1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.9.1 |
| SUSE Package Hub 15 SP5 | python-Django | 2.2.28-bp155.7.18.1 |
| Ubuntu 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.25 |
| Ubuntu 22.04 LTS | python-django | 2:3.2.12-2ubuntu1.14 |
| Ubuntu 24.04 LTS | python-django | 3:4.2.11-1ubuntu1.3 |
| Ubuntu Pro 14.04 LTS | python-django | no fix |
| Ubuntu Pro 16.04 LTS | python-django | no fix |
| Ubuntu Pro 18.04 LTS | python-django | 1:1.11.11-1ubuntu1.21+esm7 |
| openSUSE Leap 15.5 | python-Django | 2.2.28-bp155.7.18.1 |
| openSUSE Leap 15.5 | python-Django | 2.0.7-150000.1.33.1 |
| openSUSE Leap 15.6 | python-Django | 4.2.11-150600.3.9.1 |
| openSUSE Tumbleweed | python-Django | 5.1.1-1.1 |
| openSUSE Tumbleweed | python-Django | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.30-4.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.16-1.1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 |