CVE-2019-13177
verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.64%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.64% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-347
- Affected
- django-rest-registration project/django-rest-registration
- Source
- cve@mitre.org
References
- https://github.com/apragacz/django-rest-registration/releases/tag/0.5.0Release Notes, Third Party Advisory
- https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xhExploit, Patch, Third Party Advisory
- https://github.com/apragacz/django-rest-registration/releases/tag/0.5.0Release Notes, Third Party Advisory
- https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xhExploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.