CVE-2018-6188

django: Information leakage in AuthenticationForm

Published Feb 5, 2018 CVSS 3.0 · 7.5 High EPSS 4.8% KEV · Not listed
Description
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2018-0039 django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.
Github GHSA Github GHSA GHSA-rf4j-j272-fj86 Django vulnerable to information leakage in AuthenticationForm
Ubuntu USN Ubuntu USN USN-3559-1 Django vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.01547}

epss

{'score': 0.0074}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 5, 2024, 5:54 AM
Reserved
Jan 24, 2018, 12:00 AM
Status
Modified
Published
Feb 5, 2018, 3:29 AM
Modified
Jun 17, 2026, 2:01 AM
Severity
Moderate
Public date
Feb 5, 2018, 1:23 PM