An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
| Link | Tags |
|---|---|
| https://docs.djangoproject.com/en/dev/releases/security/ | vendor advisory |
| https://groups.google.com/forum/#%21forum/django-announce | permissions required |
| https://www.djangoproject.com/weblog/2024/sep/03/security-releases/ | vendor advisory |