CVE-2024-45231: Django allows enumeration of user e-mail addresses
3.7
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.16451%
CWE
Published
10/8/2024
Updated
10/30/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 5.1, < 5.1.1 | 5.1.1 |
| Django | pip | >= 5.0, < 5.0.9 | 5.0.9 |
| Django | pip | < 4.2.16 | 4.2.16 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from unhandled exceptions in PasswordResetForm's send_mail method. The commit diff shows a try-except block was added to catch email sending failures and log them instead of propagating exceptions. Prior to this fix, failed email delivery (e.g., due to backend issues) would result in server errors, creating an observable discrepancy between valid and invalid email submissions. This allowed attackers to infer registered emails based on HTTP response status codes.