Description

The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.

Remediation

References

CVE-2010-4535

Related Vulnerabilities

WordPress Plugin Funnel Builder by CartFlows-Create High Converting Sales Funnels For WordPress Cross-Site Request Forgery (1.5.15)

Plone CMS Improper Input Validation Vulnerability (CVE-2011-4462)

WordPress Plugin Images Lazyload and Slideshow Cross-Site Scripting (3.2)

Liferay Portal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-42121)

WordPress Plugin WP Custom Fields Search Cross-Site Scripting (1.2.34)

Severity

Medium

Classification

CVE-2010-4535 CWE-20

Tags

Missing Update Known Vulnerabilities