high7.5
CVE-2018-6188
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive informa…
Impact
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Djangoproject | Django | Versions 1.11.8, 1.11.9, 2.0, 2.0.1 |
| Canonical | Ubuntu Linux | Version 17.10 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securitytracker.com/id/1040422
- https://usn.ubuntu.com/3559-1/
- https://www.djangoproject.com/weblog/2018/feb/01/security-releases/
- http://www.securitytracker.com/id/1040422
- https://usn.ubuntu.com/3559-1/
- https://www.djangoproject.com/weblog/2018/feb/01/security-releases/