Description

The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.

Remediation

References

CVE-2010-4535

Related Vulnerabilities

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-1579)

MySQL CVE-2012-0112 Vulnerability (CVE-2012-0112)

WordPress Plugin Google Forms Unspecified Vulnerability (0.93)

PHP Other Vulnerability (CVE-2003-0249)

OpenSSL CVE-2023-4807 Vulnerability (CVE-2023-4807)

Severity

Medium

Classification

CVE-2010-4535 CWE-20

Tags

Missing Update Known Vulnerabilities