CVE-2018-16984: Information Exposure
(updated )
An issue was discovered in Django in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the view
permission, resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.
References
- www.securitytracker.com/id/1041749
- cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16984
- cwe.mitre.org/data/definitions/200.html
- github.com/django/django/commit/f5335bc745d4f86d355b69549712885fd1634574
- github.com/django/django/pull/10449
- nvd.nist.gov/vuln/detail/CVE-2018-16984
- www.djangoproject.com/weblog/2018/oct/01/security-release/
Detect and mitigate CVE-2018-16984 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →