Lucene search
HistoryJun 02, 2015 - 2:59 p.m.
CVE-2015-3982
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
6.4 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
56.7%
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
Affected configurations
Node
djangoprojectdjangoMatch1.8.0
ORdjangoprojectdjangoMatch1.8.1
Related
ubuntucve
ubuntucve
CVE-2015-3982
2015-05-20 00:00:00
cvelist
cvelist
CVE-2015-3982
2015-06-02 14:00:00
nessus
nessus
prion
prion
Design/Logic Flaw
2015-06-02 14:59:00
github
github
Django allows user sessions hijacking via an empty string in the session key
2022-05-17 03:29:56
osv
osv
PYSEC-2015-19
2015-06-02 14:59:00
openvas
openvas
Fedora Update for python-django FEDORA-2015-8691
2015-07-07 00:00:00
Fedora Update for python-django FEDORA-2015-11403
2015-07-24 00:00:00
fedora
fedora
[SECURITY] Fedora 22 Update: python-django-1.8.2-1.fc22
2015-05-30 15:38:05
[SECURITY] Fedora 22 Update: python-django-1.8.3-1.fc22
2015-07-23 08:54:39
cve
cve
CVE-2015-3982
2015-06-02 14:59:10
debiancve
debiancve
CVE-2015-3982
2015-06-02 14:59:10
freebsd
freebsd
django -- Fixed session flushing in the cached_db backend
2015-05-20 00:00:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
6.4 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
56.7%
Related for NVD:CVE-2015-3982