CVE-2024-45231: djangoproject django Observable Discrepancy
Vulnerability summary
CVE-2024-45231 is a medium (CVSS 5.3) Observable Discrepancy vulnerability in djangoproject django. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 13 · Related 10Timeline
- 08-10-2024PublishedVulnerability first disclosed.
- 17-03-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · PypiEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.79% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python-django< 3:3.2.25-0+deb12u1 | < 3:4.2.16-1
Djangoproject1 product
- djangoEOL≥ 4.2.0, < 4.2.16 | ≥ 5.0, < 5.0.9 | 5.1
PyPI1 product
- django≥ 5.0, < 5.0.9 | < 4.2.16 | ≥ 5.1, < 5.1.1
Ubuntu1 product
- python-djangoAll versions (No fix recorded) | < 1:1.11.11-1ubuntu1.21+esm7 | < 2:2.2.12-1ubuntu0.25 | < 2:3.2.12-2ubuntu1.14 | < 3:4.2.11-1ubuntu1.3
4 vendors · 4 products
References
16 links- docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
- www.djangoproject.com/weblog/2024/sep/03/security-releases/Vendor Advisory
- github.com/django/djangoPACKAGE
Show all 16 references
- pypi.org/project/djangoPACKAGE
