GHSA-6wgp-fwfm-mxp3

Source

https://github.com/advisories/GHSA-6wgp-fwfm-mxp3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6wgp-fwfm-mxp3/GHSA-6wgp-fwfm-mxp3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6wgp-fwfm-mxp3

Aliases

CVE-2015-3982
PYSEC-2015-19

Published

2022-05-17T03:29:56Z

Modified

2024-09-17T15:22:38Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Django allows user sessions hijacking via an empty string in the session key

Details

The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.

Database specific

{
    "cwe_ids":  [
        "CWE-384"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-29T16:20:47Z",
    "nvd_published_at":  "2015-06-02T14:59:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.8a1

Fixed

1.8.2

Affected versions

1.*

1.8a1

1.8b1

1.8b2

1.8c1

1.8

1.8.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6wgp-fwfm-mxp3/GHSA-6wgp-fwfm-mxp3.json"