Описание
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
Ссылки
- Patch
- Patch
- Patch
- PatchVendor Advisory
- Patch
- Patch
- Patch
- Patch
- PatchVendor Advisory
- Patch
Уязвимые конфигурации
Конфигурация 1Версия до 1.2.6 (включая)
Одно из
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:0.91:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:0.95:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:0.95.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:0.96:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.1:2:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.2.5:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3:alpha1:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:1.3:alpha2:*:*:*:*:*:*
EPSS
Процентиль: 81%
0.02284
Низкий
5.8 Medium
CVSS2
Дефекты
CWE-20
Связанные уязвимости
ubuntu
почти 15 лет назад
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
debian
почти 15 лет назад
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, ...
EPSS
Процентиль: 81%
0.02284
Низкий
5.8 Medium
CVSS2
Дефекты
CWE-20