Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/django/django ↗ | |
| df591468251ed489a3e147d7c359f387f4effe66 to before 38e2fdadfd9952e751deed662edf4c496d238f28 | 38e2fdadfd9952e751deed662edf4c496d238f28 |
Description
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.