Code injection

2015-08-2414:59:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.016 Low

EPSS

Percentile

87.2%

JSON

The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.

CPENameOperatorVersion
ubuntu_linuxeq12.04
ubuntu_linuxeq14.04
ubuntu_linuxeq15.04
djangoeq1.4.12
djangoeq1.7.5
djangoeq1.7.9
djangoeq1.7.3
djangoeq1.4.9
djangoeq1.8.2
djangoeq1.7 rc2

Name	Operator	Version
ubuntu_linux	eq	12.04
ubuntu_linux	eq	14.04
ubuntu_linux	eq	15.04
django	eq	1.4.12
django	eq	1.7.5
django	eq	1.7.9
django	eq	1.7.3
django	eq	1.4.9
django	eq	1.8.2
django	eq	1.7 rc2