CVE-2014-0482 Django Middleware Enables Session Hijacking
MediumCVSS 6.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | < 1.4.14 | 1.4.14 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | = 1.2.7 | No fix listed |
| pypi django(PyPI) | = 1.3 | No fix listed |
| pypi django(PyPI) | = 1.3.1 | No fix listed |
| pypi django(PyPI) | = 1.3.2 | No fix listed |
| pypi django(PyPI) | = 1.3.3 | No fix listed |
| pypi django(PyPI) | = 1.3.4 | No fix listed |
| pypi django(PyPI) | = 1.3.5 | No fix listed |
| pypi django(PyPI) | = 1.3.6 | No fix listed |
Show 78 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 1.3.7 | No fix listed |
| pypi django(PyPI) | = 1.4 | No fix listed |
| pypi django(PyPI) | = 1.4.1 | No fix listed |
| pypi django(PyPI) | = 1.4.10 | No fix listed |
| pypi django(PyPI) | = 1.4.11 | No fix listed |
| pypi django(PyPI) | = 1.4.12 | No fix listed |
| pypi django(PyPI) | = 1.4.13 | No fix listed |
| pypi django(PyPI) | = 1.4.2 | No fix listed |
| pypi django(PyPI) | = 1.4.3 | No fix listed |
| pypi django(PyPI) | = 1.4.4 | No fix listed |
| pypi django(PyPI) | = 1.4.5 | No fix listed |
| pypi django(PyPI) | = 1.4.6 | No fix listed |
| pypi django(PyPI) | = 1.4.7 | No fix listed |
| pypi django(PyPI) | = 1.4.8 | No fix listed |
| pypi django(PyPI) | = 1.4.9 | No fix listed |
| pypi django(PyPI) | >= 1.5, < 1.5.9 | 1.5.9 |
| pypi django(PyPI) | = 1.5 | No fix listed |
| pypi django(PyPI) | = 1.5.1 | No fix listed |
| pypi django(PyPI) | = 1.5.2 | No fix listed |
| pypi django(PyPI) | = 1.5.3 | No fix listed |
| pypi django(PyPI) | = 1.5.4 | No fix listed |
| pypi django(PyPI) | = 1.5.5 | No fix listed |
| pypi django(PyPI) | = 1.5.6 | No fix listed |
| pypi django(PyPI) | = 1.5.7 | No fix listed |
| pypi django(PyPI) | = 1.5.8 | No fix listed |
| pypi django(PyPI) | >= 1.6, < 1.6.6 | 1.6.6 |
| pypi django(PyPI) | = 1.6 | No fix listed |
| pypi django(PyPI) | = 1.6.1 | No fix listed |
| pypi django(PyPI) | = 1.6.2 | No fix listed |
| pypi django(PyPI) | = 1.6.3 | No fix listed |
| pypi django(PyPI) | = 1.6.4 | No fix listed |
| pypi django(PyPI) | = 1.6.5 | No fix listed |
| pypi django(PyPI) | >= 1.7a1, < 1.7c3 | 1.7c3 |
| debian/python-django(Debian:12) | < 1.6.6-1 | 1.6.6-1 |
| debian/python-django(Debian:13) | < 1.6.6-1 | 1.6.6-1 |
| debian/python-django(Debian:14) | < 1.6.6-1 | 1.6.6-1 |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| djangoproject django | = 1.6 | No fix listed |
| djangoproject django | = 1.6-beta1 | No fix listed |
| djangoproject django | = 1.6-beta2 | No fix listed |
| djangoproject django | = 1.6-beta3 | No fix listed |
| djangoproject django | = 1.6-beta4 | No fix listed |
| djangoproject django | = 1.6.1 | No fix listed |
| djangoproject django | = 1.6.2 | No fix listed |
| djangoproject django | = 1.6.3 | No fix listed |
| djangoproject django | = 1.6.4 | No fix listed |
| djangoproject django | = 1.6.5 | No fix listed |
| djangoproject django | <= 1.4.13 | No fix listed |
| djangoproject django | = 1.4 | No fix listed |
| djangoproject django | = 1.4.1 | No fix listed |
| djangoproject django | = 1.4.2 | No fix listed |
| djangoproject django | = 1.4.4 | No fix listed |
| djangoproject django | = 1.4.5 | No fix listed |
| djangoproject django | = 1.4.6 | No fix listed |
| djangoproject django | = 1.4.7 | No fix listed |
| djangoproject django | = 1.4.8 | No fix listed |
| djangoproject django | = 1.4.9 | No fix listed |
| djangoproject django | = 1.4.10 | No fix listed |
| djangoproject django | = 1.4.11 | No fix listed |
| djangoproject django | = 1.4.12 | No fix listed |
| djangoproject django | = 1.7-beta1 | No fix listed |
| djangoproject django | = 1.7-beta2 | No fix listed |
| djangoproject django | = 1.7-beta3 | No fix listed |
| djangoproject django | = 1.7-beta4 | No fix listed |
| djangoproject django | = 1.7-rc1 | No fix listed |
| djangoproject django | = 1.7-rc2 | No fix listed |
| djangoproject django | = 1.5 | No fix listed |
| djangoproject django | = 1.5-alpha | No fix listed |
| djangoproject django | = 1.5-beta | No fix listed |
| djangoproject django | = 1.5.1 | No fix listed |
| djangoproject django | = 1.5.2 | No fix listed |
| djangoproject django | = 1.5.3 | No fix listed |
| djangoproject django | = 1.5.4 | No fix listed |
| djangoproject django | = 1.5.5 | No fix listed |
| djangoproject django | = 1.5.6 | No fix listed |
| djangoproject django | = 1.5.7 | No fix listed |
| djangoproject django | = 1.5.8 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com product
- github.com
- github.com
- www.djangoproject.com technical-description vendor-advisory
- openSUSE-SU-2014:1132 vendor-advisory
- DSA-3010 vendor-advisory
- 59782 third-party-advisory vendor-advisory
- 61281 third-party-advisory vendor-advisory
- 61276 third-party-advisory vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-0482 vendor-advisory