-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from timing discrepancies in password verification for users with unusable passwords. The commit shows modifications to verify_password() in hashers.py, where a fake password hash generation was added to standardize execution time. Before this fix, early returns when encountering unusable passwords created detectable timing differences that attackers could exploit to identify valid users.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 5.0, < 5.0.7 | 5.0.7 |
| Django | pip | >= 4.2, < 4.2.14 | 4.2.14 |
Ongoing coverage of React2Shell