Medium, CVSS 6.0PyPIAmendedPublished
User passwords are stored in clear text in the Django session
CVE-2020-15105 · GHSA-vhr6-pvjm-9qwf
- Affected
- PyPI django-two-factor-auth < 1.12
- Fixed in
- 1.12· Vendor fix available
- Issue
- Impact django-two-factor-auth versions 1.11 and before store the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authentication code. This means that the password is stored in clear text in the session for an arbitrary amount of time, and potentially forever if the user begins the login process by entering their username and password, and then leaves before entering their two-factor authentication code. The severity of this issue depends on which type of session storage you have configured: in the worst case, if you're using Django's default database session storage, then users' password are stored in clear text in your database. In the best case, if you're using Django's signed cookie session, then users' passwords are only stored in clear text within their browser's cookie store. In the common case of…
Recommended action: Upgrade to 1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.