CVE-2018-6188
CVE-2018-6188
This page contains facts from public vulnerability sources. Check the original advisory before updating.
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.
CVSS 7.5 · High · EPSS 4.8% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
python-django Debian:12
- Affected ranges
- ECOSYSTEM: < 1:1.11.10-1
Update to 1:1.11.10-1
python-django Debian:13
- Affected ranges
- ECOSYSTEM: < 1:1.11.10-1
Update to 1:1.11.10-1
python-django Debian:14
- Affected ranges
- ECOSYSTEM: < 1:1.11.10-1
Update to 1:1.11.10-1
django PyPI
- Versions
- 2.0
- 2.0.1
- 2.0a1
- 2.0b1
- 2.0rc1
- Affected ranges
- ECOSYSTEM: ≥ 2.0a1, < 2.0.2
Update to 2.0.2
django PyPI
- Versions
- 1.11.8
- 1.11.9
- Affected ranges
- ECOSYSTEM: ≥ 1.11.8, < 1.11.10
Update to 1.11.10
django PyPI
- Versions
- 2.0
- 2.0.1
- Affected ranges
- ECOSYSTEM: ≥ 2.0, < 2.0.2
Update to 2.0.2