CVE-2010-4535
Improper date handling in Django
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
Exploit likelihood
What each source reports
NVD Score used
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
CVE-2010-4535- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
CVE-2010-4535- Updated
- 2026-11-02
EUVDEUVD-2011-0012 No score
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
EUVD-2011-0012- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7wph-fc4w-wqp2
Improper date handling in Django
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
GHSA-7wph-fc4w-wqp2- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-7wph-fc4w-wqp2
Improper date handling in Django
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
GHSA-7wph-fc4w-wqp2- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
CVE-2010-4535- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-4535 No score
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
DEBIAN-CVE-2010-4535- Updated
- 2026-11-02
OSVPYSEC-2011-29 No score
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
PYSEC-2011-29- Updated
- 2026-11-02
OSVPYSEC-2011-9 No score
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
- Record
PYSEC-2011-9- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
before 1.1.3 | 1.1.3 |
djangoPyPI |
1.2 up to 1.2.4 | 1.2.4 |
python-djangoDebian:12 |
before 1.2.4-1 | 1.2.4-1 |
python-djangoDebian:13 |
before 1.2.4-1 | 1.2.4-1 |
python-djangoDebian:14 |
before 1.2.4-1 | 1.2.4-1 |
djangoPyPI |
before 1.1.3, plus listed versions 1.0.11.0.21.0.31.0.41.11.1.11.1.2 |
1.1.3 |
djangoPyPI |
1.2 up to 1.2.4, plus listed versions 1.2.11.2.21.2.3 |
1.2.4 |
djangoPyPI |
before 1.1.3, 1.2 up to 1.2.4, plus listed versions 1.0.11.0.21.0.31.0.41.1 Show 5 moreShow less1.1.11.1.21.2.11.2.21.2.3 |
1.1.31.2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-4535 is a medium vulnerability (CVSS 5.0) in Djangoproject Django, published January 10, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.40%, the 88th percentile. Fixed in django 1.1.3.
References
code.djangoproject.com/changeset/15032
openwall.com/lists/oss-security/2010/12/23/4
ubuntu.com/usn/USN-1040-1
securityfocus.com/bid/45563
secunia.com/advisories/42913
Show 17 moreShow less
vupen.com/english/advisories/2011/0048
djangoproject.com/weblog/2010/dec/22/security
lists.fedoraproject.org/pipermail/package-announce/2011-January/053041.html
bugzilla.redhat.com/show_bug.cgi?id=665373
nvd.nist.gov/vuln/detail/CVE-2010-4535
github.com/advisories/GHSA-7wph-fc4w-wqp2
web.archive.org/web/20200228193349/http://www.securityfocus.com/bid/45563
security-tracker.debian.org/tracker/CVE-2010-4535