In short
- CVE-2018-6596 is a CRITICAL (CVSS 9.1) vulnerability affecting django-anymail, django-anymail (django-anymail project).
- Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.5% of all vulnerabilities.
- Fix: update to 1.2.1 or later.
Description
webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.
NVD description
webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.
More vulnerabilities in django-anymail
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free