CoreCVE
Back

HIGH

django: Information leakage in AuthenticationForm

Published Feb 5, 2018

Description

django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.

Affected products

Remediation

Red Hat statement

This issue affects the versions of python-django as shipped with Red Hat Satellite version 6. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. This issue affects the versions of python-django as shipped with Red Hat Subscription Asset Manager version 1. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Metrics

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-209

References (12)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Feb 5, 2018
Updated Aug 5, 2024
Reserved Jan 24, 2018
Link CVE-2018-6188
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-6188
Red Hat
Severity Moderate
Public date Feb 5, 2018
Links CVE-2018-6188 - Bugzilla
GHSA-RF4J-J272-FJ86