You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.
CVE-2018-16984 - Medium Severity Vulnerability
Vulnerable Libraries - Django-1.9.6-py2.py3-none-any.whl, Django-1.7.1-py2.py3-none-any.whl
Django-1.9.6-py2.py3-none-any.whl
A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
path: /example-python
Library home page: https://pypi.python.org/packages/cb/97/081df31f2a3850988b92ad4464e95f9e4b257aa5a34e120bca89c260de96/Django-1.9.6-py2.py3-none-any.whl
Dependency Hierarchy:
Django-1.7.1-py2.py3-none-any.whl
A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
path: /example-python/requirements.txt
Library home page: https://pypi.python.org/packages/d2/29/1935a5825b8820d1e398ab83f0730d483ec731fae34745ddac8318cf6ac8/Django-1.7.1-py2.py3-none-any.whl
Dependency Hierarchy:
Vulnerability Details
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.
Publish Date: 2018-10-02
URL: CVE-2018-16984
CVSS 3 Score Details (4.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-16984
Release Date: 2018-10-02
Fix Resolution: 2.1.2
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: