Description

The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.

Remediation

References

CVE-2010-4535

Related Vulnerabilities

Piwigo Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Vulnerability (CVE-2023-44393)

WordPress Plugin Helpful Security Bypass (4.5.14)

WordPress Plugin Ultimate Gift Cards For WooCommerce Cross-Site Request Forgery (2.1.1)

Jboss EAP Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2016-4993)

WordPress 2.3.3 Directory Traversal Vulnerability (0.6.2 - 2.3.3)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2010-4535