PT-2024-6224 · Django+5 · Django+5
Published
2024-06-23
·
Updated
2026-01-03
·
CVE-2024-39329
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.13
Django versions 5.0 through 5.0.6
Description
The issue allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. This is due to the
django.contrib.auth.backends.ModelBackend.authenticate() method. The vulnerability can be exploited to gain unauthorized access to protected information.Recommendations
For Django versions 4.2 through 4.2.13, update to version 4.2.14 or later.
For Django versions 5.0 through 5.0.6, update to version 5.0.7 or later.
As a temporary workaround, consider restricting access to the
django.contrib.auth.backends.ModelBackend.authenticate() method until a patch is available.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Django
Linuxmint
Suse
Ubuntu