Lucene search
GitHub Advisory DatabaseGHSA-6WGP-FWFM-MXP3HistoryMay 17, 2022 - 3:29 a.m.
Django allows user sessions hijacking via an empty string in the session key
2022-05-1703:29:56
GitHub Advisory Database
github.com
6
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
6.8 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
56.7%
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
Affected configurations
Node
django-registration_projectdjango-registrationRange<1.8.2django
Related
ubuntucve
ubuntucve
CVE-2015-3982
2015-05-20 00:00:00
cvelist
cvelist
CVE-2015-3982
2015-06-02 14:00:00
nessus
nessus
nvd
nvd
CVE-2015-3982
2015-06-02 14:59:10
prion
prion
Design/Logic Flaw
2015-06-02 14:59:00
osv
osv
PYSEC-2015-19
2015-06-02 14:59:00
debiancve
debiancve
CVE-2015-3982
2015-06-02 14:59:10
freebsd
freebsd
django -- Fixed session flushing in the cached_db backend
2015-05-20 00:00:00
openvas
openvas
Fedora Update for python-django FEDORA-2015-8691
2015-07-07 00:00:00
Fedora Update for python-django FEDORA-2015-11403
2015-07-24 00:00:00
fedora
fedora
[SECURITY] Fedora 22 Update: python-django-1.8.2-1.fc22
2015-05-30 15:38:05
[SECURITY] Fedora 22 Update: python-django-1.8.3-1.fc22
2015-07-23 08:54:39
cve
cve
CVE-2015-3982
2015-06-02 14:59:10
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
6.8 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
56.7%
Related for GHSA-6WGP-FWFM-MXP3