CVE-2019-19844
CriticalPublic exploitDjango Potential account hijack via password reset form
Published Jan 16, 2020 · Updated Aug 22, 2026 · Also known as ALPINE-CVE-2019-19844, DEBIAN-CVE-2019-19844, DLA-2042-1, DSA-4598-1, GHSA-vfq6-hq5r-27r6, PYSEC-2019-16, UBUNTU-CVE-2019-19844, USN-4224-1, USN-6722-1
Key Facts
Patch immediately- CVE-2019-19844 is a critical-severity vulnerability (CVSS 9.3 v4) affecting Django (Djangoproject), Ubuntu Linux (Canonical), python-Django (arch) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 54% probability of exploitation in the next 30 days.
- Fixed versions are available, including ansible 2.2.3.0-12.2, ansible 2.9.14-3.15.1, ansible1 1.9.6-9.7.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v4
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS (30-day exploit likelihood)
54%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2019-19844 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Affected Products
869 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DjangoDjangoproject | 3.0, >= 3.0 | 1.11.27 |
| Ubuntu LinuxCanonical | 16.04, 18.04, 19.04, 19.10 | n/a |
| python-Djangoarch | See advisory | 2.2.9-1 |
| py3-djangoalpine | See advisory | 1.11.27-r0 |
| py-djangoalpine | See advisory | 1.11.27-r0 |
Patched Releases
ansible
2.2.3.0-12.2, 2.9.14-3.15.1
ansible1
1.9.6-9.7.2
ardana-ansible
8.0+git.1596735237.54109b1-3.77.1, 9.0+git.1591138508.e269bdb-3.22.2
ardana-cinder
8.0+git.1596129856.263f430-3.43.1
ardana-cobbler
9.0+git.1588181228.bae3b1f-3.13.2
ardana-glance
8.0+git.1593631779.76fa9b7-3.24.1, 9.0+git.1593631708.9354a78-3.13.2
ardana-input-model
9.0+git.1589740948.c24fc0b-3.19.2
ardana-logging
9.0+git.1591193994.d93b668-3.13.2
ardana-manila
9.0+git.1594158642.b5905e4-3.12.2
ardana-monasca
9.0+git.1589385256.7fbfaaf-3.19.2
ardana-mq
8.0+git.1593618123.678c32b-3.26.1, 9.0+git.1593618110.cbd1a37-3.16.2
ardana-neutron
9.0+git.1590756257.e09d54f-3.22.2
ardana-nova
8.0+git.1601298847.dd01585-3.42.1
ardana-octavia
9.0+git.1590079609.a2ae6ab-3.19.2
ardana-osconfig
8.0+git.1595885113.93abcbc-3.49.1
ardana-tempest
9.0+git.1593033709.9495bb2-3.16.2
crowbar-core
4.0+git.1580209654.1d112d31f-9.66.5, 5.0+git.1600432272.b3ad722f0-3.44.1, 6.0+git.1594619891.b75a61d0d-3.25.5
crowbar-core-branding-upstream
4.0+git.1580209654.1d112d31f-9.66.5, 5.0+git.1600432272.b3ad722f0-3.44.1, 6.0+git.1594619891.b75a61d0d-3.25.5
crowbar-ha
4.0+git.1585316203.d6ad2c8-4.52.4
crowbar-openstack
4.0+git.1589804581.9972163f0-9.71.4, 5.0+git.1599037158.5c4d07480-4.43.1, 6.0+git.1591795073.49cb6400e-3.25.3
Django
1.11.27, 2.2.9, 3.0.1
documentation-hpe-helion-openstack-installation
8.20201007-1.29.1
documentation-hpe-helion-openstack-operations
8.20201007-1.29.1
documentation-hpe-helion-openstack-opsconsole
8.20201007-1.29.1
documentation-hpe-helion-openstack-planning
8.20201007-1.29.1
Timeline
Publicly disclosed
Jan 16, 2020
Last updated
Aug 22, 2026
Weakness Type
- CWE-290 Authentication Bypass by Spoofing
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
References
- advisoryhttps://bugzilla.suse.com/1008037
- advisoryhttps://bugzilla.suse.com/1008038
- advisoryhttps://bugzilla.suse.com/1010940
- advisoryhttps://bugzilla.suse.com/1019021
- advisoryhttps://bugzilla.suse.com/1019111
FAQ
Common Questions.
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.
Affected: Django (Djangoproject) versions 3.0, >= 3.0; Ubuntu Linux (Canonical) versions 16.04, 18.04, 19.04, 19.10; python-Django (arch), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including ansible 2.2.3.0-12.2, ansible 2.9.14-3.15.1, ansible1 1.9.6-9.7.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-19844 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo