What is GHSA-37cf-r3w2-gjfw?

GHSA-37cf-r3w2-gjfw is a security advisory published by GitHub Security Advisories with High severity. django-nopassword stores secrets in cleartext

Which CVE IDs does GHSA-37cf-r3w2-gjfw cover?

GHSA-37cf-r3w2-gjfw covers the following CVE IDs: CVE-2019-10682. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-37cf-r3w2-gjfw?

GHSA-37cf-r3w2-gjfw has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-37cf-r3w2-gjfw?

GHSA-37cf-r3w2-gjfw affects 1 product, including: pip/django-nopassword:\u003c 5.0.0.

GHSA-37cf-r3w2-gjfwHighCVSS 7.5

django-nopassword stores secrets in cleartext

Vendor

GitHub Security Advisories

Published

June 5, 2020

Last Modified

September 16, 2024

🔗 CVE IDs covered (1)

CVE-2019-10682 →

📋 Description

django-nopassword before 5.0.0 stores cleartext secrets in the database.

🎯 Affected products1

pip/django-nopassword:< 5.0.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-10682
https://github.com/relekang/django-nopassword/commit/d8b4615f5fbfe3997d96cf4cb3e342406396193c
https://github.com/relekang/django-nopassword/blob/8e8cfc765ee00adfed120c2c79bf71ef856e9022/nopassword/models.py#L14
https://github.com/relekang/django-nopassword/compare/v4.0.1...v5.0.0
https://github.com/advisories/GHSA-37cf-r3w2-gjfw
https://github.com/pypa/advisory-database/tree/main/vulns/django-nopassword/PYSEC-2020-229.yaml