{"action":"Upgrade django to 2.1.2 or later.","affected":[{"fixed":"2.1.2","introduced":"2.1"}],"component":"django","cve_ids":["CVE-2018-16984"],"ecosystem":"PyPI","epss":0.0205,"exploited":false,"fixed_versions":["2.1.2"],"ghsa_id":"GHSA-6mx3-3vqg-hpp2","id":"tcs_01M5KF3S56V2A4ZXS2CGYXQYS4","modified_at":"2024-09-18T19:07:30.122563Z","published_at":"2018-10-03T20:07:39Z","references":["https://osv.dev/vulnerability/GHSA-6mx3-3vqg-hpp2","https://nvd.nist.gov/vuln/detail/CVE-2018-16984","https://github.com/django/django/commit/bf39978a53f117ca02e9a0c78b76664a41a54745","https://github.com/advisories/GHSA-6mx3-3vqg-hpp2","https://github.com/django/django","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2018-3.yaml","https://security.netapp.com/advisory/ntap-20190502-0009","https://web.archive.org/web/20200517123022/http://www.securitytracker.com/id/1041749","https://www.djangoproject.com/weblog/2018/oct/01/security-release"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-6mx3-3vqg-hpp2","url":"https://osv.dev/vulnerability/GHSA-6mx3-3vqg-hpp2"}],"summary":"Django allows unprivileged users to read the password hashes of arbitrary accounts"}