CVE-2024-39329
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.
MEDIUM · CVSS 5.3
EPSS 0.00165
Schedule remediation
- SSVC automatable: yes - attacks can be scripted at scale
Sigma rules1
YARA rules0