CVE-2011-4136

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session…

published October 19, 2011

CVSS
—
EPSS
2%
Percentile
82.9
In the wild
Unconfirmed
What it is

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02284 · 82.9th percentile
Published
2011-10-19T10:00Z
EPSS history
Timeline
  • 19 OCT 10:00Z
    django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session…
    cvelistv5