GitHub Advisoryadvisory · PyPI

GHSA-6wgp-fwfm-mxp3 Django allows user sessions hijacking via an empty string in the session key

MEDIUM Published 2022-05-17 Modified 2024-09-17 Official page ↗
Aliases
CVE-2015-3982
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-384
Reviewed
2024-04-29

Affected packages

• PyPI Django: >= 1.8a1, < 1.8.2 → fixed in 1.8.2

Description

The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.

Related

Alias · CVE (1)

  • CVE-2015-3982 The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References