GitHub Advisoryadvisory · PyPI

GHSA-x88j-93vc-wpmp Session manipulation in Django

MEDIUM Published 2018-07-23 Modified 2024-09-16 Official page ↗
Aliases
CVE-2011-4136
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• PyPI Django: < 1.2.7 → fixed in 1.2.7 • PyPI Django: >= 1.3, < 1.3.1 → fixed in 1.3.1

Description

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.

Related

Alias · CVE (1)

  • CVE-2011-4136 django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References