CVE-2019-13177

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.64%

Published

Jul 2, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.

Weaknesses (CWE)

CWE-347

Affected Products (1)

django-rest-registration_project · django-rest-registration (up to 0.5.0)vulnerable

References (4)

https://github.com/apragacz/django-rest-registration/releases/tag/0.5.0

Release NotesThird Party Advisory

https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xh

ExploitPatchThird Party Advisory

https://github.com/apragacz/django-rest-registration/releases/tag/0.5.0

Release NotesThird Party Advisory

https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xh

ExploitPatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs