PT-2007-1876 · Django · Django

Publicado 2007-01-23 · Atualizado 2022-05-01 · CVE-2007-0405

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Django version 0.95

Description The issue is related to the LazyUser class in the AuthenticationMiddleware, which does not properly cache the user name across requests. This allows remote authenticated users to gain the privileges of a different user.

Recommendations For Django version 0.95, consider updating to a newer version that addresses this issue, as the current version does not properly handle user authentication across requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-0405

GHSA-MWV2-398H-V489

Produtos afetados

Django

Referências · 12

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/3c5782287e · Nota
• https://github.com/django/django/commit/e89f0a65581f82a5740bfe989136cea75d09cd67 · Nota
• http://secunia.com/advisories/23826 · Aviso do Fabricante
• http://securityfocus.com/bid/22138 · Nota
• https://osv.dev/vulnerability/GHSA-mwv2-398h-v489 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-0405 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31628 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-0405 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-0405 · Aviso do Fabricante
• http://code.djangoproject.com/changeset/3754 · Nota
• https://osv.dev/vulnerability/CVE-2007-0405 · Aviso do Fabricante