Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-x4x4-mzaz-xkg3
Summary
### Impact

The use of `String.to_atom/1` in PowAssent is susceptible to denial of
service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is
fetched from the user provided params, and `String.to_atom/1` is used to
convert the binary value to an atom so it can be used to fetch the provider
configuration value. This is unsafe as it's user provided data, and can be
used to fill up the whole atom table of ~1M which will cause the app to
crash.

### Workarounds

A plug can be used to validate `conn.params["provider"]` before it reaches
the `PowAssent.Phoenix.AuthorizationController`.

### References

http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1
Aliases
0
alias CVE-2019-16764
1
alias GHSA-5653-437f-5hmc
Fixed_packages
0
url pkg:hex/pow_assent@0.4.4
purl pkg:hex/pow_assent@0.4.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.4.4
Affected_packages
0
url pkg:hex/pow_assent@0.1.0-alpha
purl pkg:hex/pow_assent@0.1.0-alpha
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha
1
url pkg:hex/pow_assent@0.1.0-alpha.1
purl pkg:hex/pow_assent@0.1.0-alpha.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.1
2
url pkg:hex/pow_assent@0.1.0-alpha.2
purl pkg:hex/pow_assent@0.1.0-alpha.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.2
3
url pkg:hex/pow_assent@0.1.0-alpha.3
purl pkg:hex/pow_assent@0.1.0-alpha.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.3
4
url pkg:hex/pow_assent@0.1.0-alpha.4
purl pkg:hex/pow_assent@0.1.0-alpha.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.4
5
url pkg:hex/pow_assent@0.1.0-alpha.5
purl pkg:hex/pow_assent@0.1.0-alpha.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.5
6
url pkg:hex/pow_assent@0.1.0-alpha.6
purl pkg:hex/pow_assent@0.1.0-alpha.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.6
7
url pkg:hex/pow_assent@0.1.0-alpha.7
purl pkg:hex/pow_assent@0.1.0-alpha.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.7
8
url pkg:hex/pow_assent@0.1.0-alpha.8
purl pkg:hex/pow_assent@0.1.0-alpha.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.8
9
url pkg:hex/pow_assent@0.1.0-alpha.9
purl pkg:hex/pow_assent@0.1.0-alpha.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.9
10
url pkg:hex/pow_assent@0.1.0-alpha.10
purl pkg:hex/pow_assent@0.1.0-alpha.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.10
11
url pkg:hex/pow_assent@0.1.0-alpha.11
purl pkg:hex/pow_assent@0.1.0-alpha.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.11
12
url pkg:hex/pow_assent@0.1.0-alpha.12
purl pkg:hex/pow_assent@0.1.0-alpha.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-alpha.12
13
url pkg:hex/pow_assent@0.1.0-rc.0
purl pkg:hex/pow_assent@0.1.0-rc.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-rc.0
14
url pkg:hex/pow_assent@0.1.0-rc.1
purl pkg:hex/pow_assent@0.1.0-rc.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-rc.1
15
url pkg:hex/pow_assent@0.1.0-rc.2
purl pkg:hex/pow_assent@0.1.0-rc.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0-rc.2
16
url pkg:hex/pow_assent@0.1.0
purl pkg:hex/pow_assent@0.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.1.0
17
url pkg:hex/pow_assent@0.2.0
purl pkg:hex/pow_assent@0.2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.2.0
18
url pkg:hex/pow_assent@0.2.1
purl pkg:hex/pow_assent@0.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.2.1
19
url pkg:hex/pow_assent@0.2.2
purl pkg:hex/pow_assent@0.2.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.2.2
20
url pkg:hex/pow_assent@0.2.3
purl pkg:hex/pow_assent@0.2.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.2.3
21
url pkg:hex/pow_assent@0.2.4
purl pkg:hex/pow_assent@0.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.2.4
22
url pkg:hex/pow_assent@0.3.0
purl pkg:hex/pow_assent@0.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.3.0
23
url pkg:hex/pow_assent@0.3.1
purl pkg:hex/pow_assent@0.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.3.1
24
url pkg:hex/pow_assent@0.3.2
purl pkg:hex/pow_assent@0.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.3.2
25
url pkg:hex/pow_assent@0.4.0
purl pkg:hex/pow_assent@0.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.4.0
26
url pkg:hex/pow_assent@0.4.1
purl pkg:hex/pow_assent@0.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.4.1
27
url pkg:hex/pow_assent@0.4.2
purl pkg:hex/pow_assent@0.4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.4.2
28
url pkg:hex/pow_assent@0.4.3
purl pkg:hex/pow_assent@0.4.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-x4x4-mzaz-xkg3
resource_url http://public2.vulnerablecode.io/packages/pkg:hex/pow_assent@0.4.3
References
0
reference_url http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-16764
reference_id
reference_type
scores
0
value 0.00441
scoring_system epss
scoring_elements 0.6366
published_at 2026-06-11T12:55:00Z
1
value 0.00441
scoring_system epss
scoring_elements 0.63761
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-16764
2
reference_url https://github.com/pow-auth/pow_assent
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pow-auth/pow_assent
3
reference_url https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf
4
reference_url https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986
5
reference_url https://hex.pm/packages/pow_assent
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://hex.pm/packages/pow_assent
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-16764
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-16764
Weaknesses
0
cwe_id 400
name Uncontrolled Resource Consumption
description The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-x4x4-mzaz-xkg3