CVE-2018-16984

{"id": "CVE-2018-16984", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2018-10-02T18:29:01.430", "references": [{"url": "http://www.securitytracker.com/id/1041749", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20190502-0009/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.djangoproject.com/weblog/2018/oct/01/security-release/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the \"view\" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes."}, {"lang": "es", "value": "Se ha descubierto un problema en Django, en versiones 2.1 anteriores a la 2.1.2, por el cual los usuarios no privilegiados pueden leer los hashes de contrase\u00f1a de cuentas arbitrarias. El widget de contrase\u00f1a de solo lectura empleada por el administrador de Django para mostrar un hash de contrase\u00f1a ofuscada se omit\u00eda si un usuario ten\u00eda solo el permiso \"view\" (nuevo en Django 2.1), lo que resultaba en que el hash de contrase\u00f1a completo se mostraba a esos usuarios. Esto podr\u00eda resultar en una vulnerabilidad para sitios en los que las cuentas de usuario heredadas emplean hashes inseguros."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E62D06FC-9AAD-41BF-9A40-2800A0ECCAFB", "versionEndExcluding": "2.1.2", "versionStartIncluding": "2.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}