Nextcloud · Report #761329
Update App Store: Django account high jacking vulnerability
Validstatus
mediumseverity
11upvotes
31 Jan 2020disclosed
How it was found
High Severity Framework Security Fix
Impact
There's a nasty bug that allows accounts to be highjacked. Attackers still can't distribute archive since they are signed but can highjack admin accounts and swap out packges in the admin panel. I've updated the deps, tests work fine locally but you should check just to be sure and deploy the latest master branch ASAP