Python Library Django 4.2.x < 4.2.16 / 5.0.x < 5.0.9 / 5.1.x < 5.1.1 Multiple Vulnerabilities

high Nessus Plugin ID 206676

Synopsis

A Python library installed on the remote host is affected by multiple vulnerabilities.

Description

The detected version of the Django Python package, Django, is 4.2.x prior to 4.2.16, 5.0.x prior to 5.0.9 or 5.1.x prior to 5.1.1. It is, therefore, affected by multiple vulnerabilities as disclosed in Django's September 3rd 2024 security advisory:

- urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. (CVE-2024-45230)
- Due to unhandled email sending failures, the django.contrib.auth.forms.PasswordResetForm class allowed remote attackers to enumerate user emails by issuing password reset requests and observing the outcomes.
(CVE-2024-45231)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Django version 4.2.16, 5.0.9, 5.1.1 or later.

Plugin Details

Severity: High

ID: 206676

File Name: python_django_5_1_1.nasl

Version: 1.3

Type: local

Family: Misc.

Published: 9/5/2024

Updated: 9/6/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-45230

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:djangoproject:django

Exploit Ease: No known exploits are available

Patch Publication Date: 9/3/2024

Vulnerability Publication Date: 9/3/2024

Reference Information

CVE: CVE-2024-45230, CVE-2024-45231

IAVA: 2024-A-0540

Detections

Analytics