-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from unhandled exceptions in PasswordResetForm's send_mail method. The commit diff shows a try-except block was added to catch email sending failures and log them instead of propagating exceptions. Prior to this fix, failed email delivery (e.g., due to backend issues) would result in server errors, creating an observable discrepancy between valid and invalid email submissions. This allowed attackers to infer registered emails based on HTTP response status codes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 5.1, < 5.1.1 | 5.1.1 |
| Django | pip | >= 5.0, < 5.0.9 | 5.0.9 |
| Django | pip | < 4.2.16 | 4.2.16 |
Ongoing coverage of React2Shell