PT-2014-3650 · Django Software Foundation+1 · Django+1

David Greisen · Published 2014-08-26 · Updated 2022-05-14 · CVE-2014-0482

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.13 Django versions 1.5.x through 1.5.8 Django versions 1.6.x through 1.6.5 Django versions 1.7 before release candidate 3

Description The issue allows remote authenticated users to hijack web sessions via vectors related to the REMOTE USER header when using the contrib.auth.backends.RemoteUserBackend backend with the contrib.auth.middleware.RemoteUserMiddleware middleware.

Recommendations For Django versions 1.4.x through 1.4.13, update to version 1.4.14 or later. For Django versions 1.5.x through 1.5.8, update to version 1.5.9 or later. For Django versions 1.6.x through 1.6.5, update to version 1.6.6 or later. For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-0482

DLA-65-1

DSA-3010-1

GHSA-625G-GX8C-XCMG

MGASA-2014-0366

PYSEC-2014-6

SUSE-SU-2015:0563-1

SUSE-SU-2015:0695-1

USN-2347-1

Affected Products

Django

Ubuntu

References · 30

• https://osv.dev/vulnerability/USN-2347-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0482 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Vendor Advisory
• https://djangoproject.com/weblog/2014/aug/20/security · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0366 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0481 · Vendor Advisory
• http://debian.org/security/2014/dsa-3010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0482 · Security Note
• https://ubuntu.com/security/notices/USN-2347-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0366.html · Security Note
• https://cve.org/CVERecord?id=CVE-2014-0482 · Security Note
• https://ubuntu.com/security/CVE-2014-0483 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0480 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-6 · Vendor Advisory