Auth bypass in Djangoproject Django
CVE-2014-0482
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.
Vulnerability class: Broken Authentication
EPSS: 0.020 (78.3th percentile) — read the EPSS interpretation.
Affected products
- Djangoproject Django — versions 1.6, 1.6.1, 1.6.2
- Opensuse — versions 12.3, 13.1
- N/a — versions n/a
Weakness classification (CWE)
References
- security@debian.org (x_refsource_CONFIRM, Vendor Advisory)
- security@debian.org (x_refsource_SECUNIA, third-party-advisory)
- security@debian.org (x_refsource_SECUNIA, third-party-advisory)
- security@debian.org (vendor-advisory, x_refsource_SUSE)
- security@debian.org (vendor-advisory, x_refsource_DEBIAN)
- security@debian.org (x_refsource_SECUNIA, third-party-advisory)