CVE-2024-45231: Django CVE-2024-45230 and CVE-2024-45231
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
Other sources
Django could allow a remote attacker to obtain sensitive information, caused by unhandled email sending failures. By sending a specially crafted password reset request, an attacker could exploit this vulnerability to enumerate user email information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45231?
CVE-2024-45231 has been classified as a medium severity vulnerability due to its potential for user enumeration.
How do I fix CVE-2024-45231?
To fix CVE-2024-45231, upgrade your Django installation to versions 5.1.1, 5.0.9, or 4.2.16.
What versions of Django are affected by CVE-2024-45231?
CVE-2024-45231 affects Django versions prior to 5.1.1, including 5.0.9 and 4.2.16.
Can CVE-2024-45231 lead to account compromise?
CVE-2024-45231 allows attackers to enumerate valid email addresses but does not directly lead to account compromise.
Is user action required to exploit CVE-2024-45231?
Yes, an attacker must initiate a password reset request, making user action necessary for exploitation of CVE-2024-45231.