5.8

CVE-2011-4136

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.

Data is provided by the National Vulnerability Database (NVD)
Djangoproject ≫ Django Version <= 1.2.6
Djangoproject ≫ Django Version0.91
Djangoproject ≫ Django Version0.95
Djangoproject ≫ Django Version0.95.1
Djangoproject ≫ Django Version0.96
Djangoproject ≫ Django Version1.0
Djangoproject ≫ Django Version1.0.1
Djangoproject ≫ Django Version1.0.2
Djangoproject ≫ Django Version1.1
Djangoproject ≫ Django Version1.1.0
Djangoproject ≫ Django Version1.1.2
Djangoproject ≫ Django Version1.1.3
Djangoproject ≫ Django Version1.2
Djangoproject ≫ Django Version1.2.1
Djangoproject ≫ Django Version1.2.1 Update2
Djangoproject ≫ Django Version1.2.2
Djangoproject ≫ Django Version1.2.3
Djangoproject ≫ Django Version1.2.4
Djangoproject ≫ Django Version1.2.5
Djangoproject ≫ Django Version1.3
Djangoproject ≫ Django Version1.3 Updatealpha1
Djangoproject ≫ Django Version1.3 Updatealpha2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.02% 0.752
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:N/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.