Description
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.
Remediation
References
Related Vulnerabilities
Jenkins Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-10384)
phpMyAdmin Improper Input Validation Vulnerability (CVE-2017-1000018)
Joomla! Core Security Bypass (1.7.0 - 3.9.22)
Oracle Application Server Other Vulnerability (CVE-2007-2119)
WordPress Plugin Ultimate Reviews PHP Object Injection (2.1.32)