Vulnerability advisory

GHSA-6wgp-fwfm-mxp3

Django allows user sessions hijacking via an empty string in the session key

Published May 17, 2022Updated Sep 17, 2024OSV record ↗

Also known as CVE-2015-3982PYSEC-2015-19

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`1.8a1` to before 1.8.2	`1.8.2`Advisories →
Also listed as affected (6) `1.8` `1.8.1` `1.8a1` `1.8b1` `1.8b2` `1.8c1`

Description

The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2015-3982 ↗
Webgithub.com/django/django/commit/31cb25adecba930bdeee4556709f5a1c42d88fd6 ↗
Packagegithub.com/django/django ↗
Webgithub.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-19.yaml ↗
Webweb.archive.org/web/20200228092138/http://www.securityfocus.com/bid/74960 ↗
Webwww.djangoproject.com/weblog/2015/may/20/security-release ↗