Vulnerability in Djangoproject Django

CVE-2015-3982

The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.

EPSS: 0.017 (75.5th percentile) — read the EPSS interpretation.

Affected products

Djangoproject Django — versions 1.8.0, 1.8.1
N/a — versions n/a

References

cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
cve@mitre.org (vdb-entry, x_refsource_BID)