$ cve CVE-2019-19844 JSON

CVE-2019-19844 EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 53.6% (pctl 99)

Patch early

A public exploit exists.

Description

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	53.56% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-640
On CISA KEV	no
Public exploit	yes
Published	2019-12-18
Last modified	2026-06-17

Affected (2)

Vendor	Product
canonical	ubuntu linux
djangoproject	django

Public exploits

Source	Title	Date
exploit-db	Django < 3.0 < 2.2 < 1.11 - Account Hijack	2019-12-24

References

→ the Explorer · watch your stack · NVD