DemoBook a demo

Vulnerability advisory

CVE-2019-19844

Published Updated OSV record ↗

Also known as GHSA-vfq6-hq5r-27r6PYSEC-2019-16

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
All commits before 358973a12eb3105ba084a2d594428a19223b8582358973a12eb3105ba084a2d594428a19223b8582
2a62cdcfec85938f40abb2e9e6a9ff497e02afe8 to before c494d90c195a739a7298b073eaa6ed987c2fd0bcc494d90c195a739a7298b073eaa6ed987c2fd0bc
2a04e24d2dfc8e60a66e4369d970913cb2112d91 through 2a04e24d2dfc8e60a66e4369d970913cb2112d91No fix listed
Also listed as affected (51)
  • 3.0
  • stable/3.0.x
  • 2.2.8
  • 1.11.26
  • 2.2.7
  • 2.2.6
  • 1.11.25
  • 2.2.5
  • 1.11.24
  • 2.2.4
  • 1.11.23
  • 1.11.22
  • 2.2.3
  • 2.2.2
  • 1.11.21
  • 2.2.1
  • 2.2
  • 2.2rc1
  • 1.11.20
  • 1.11.19
  • 2.2b1
  • 2.2a1
  • 1.11.18
  • 1.11.17
  • 1.11.16
  • 1.11.15
  • 1.11.14
  • 1.11.13
  • 1.11.12
  • 1.11.11
  • 1.11.10
  • 1.11.9
  • 1.11.8
  • 1.11.7
  • 1.11.6
  • 1.11.5
  • 1.11.4
  • 1.11.3
  • 1.11.2
  • 1.11.1
  • 1.11
  • 1.11rc1
  • 1.11b1
  • 1.11a1
  • 1.7a2
  • 1.4
  • 1.3
  • 1.2.1
  • 1.2
  • 1.1
  • 1.0

Description

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.