Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST (djangoproject Django)
En bref
- Source
- NVD
- EPSS
- EPSS 0.54 % · centile 46 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- DSF
- Statut NVD
- Analyzed
Description
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Faiblesses (CWE)
- CWE-539 — Use of Persistent Cookies Containing Sensitive Information
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | LOW 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | DSF |
| CVSS 4.0 | LOW 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-7h2m-m8vj-598h — Django Uses Persistent Cookies Containing Sensitive Information
- PYSEC-2026-50 — An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
Références européennes
- ENISA EUVD · EUVD-2026-27347
- GCVE · GCVE-0-2026-35192
Configurations affectées (CPE NVD)
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*≥ 5.2 < 5.2.14cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*≥ 6.0 < 6.0.5
Produits affectés
| Produit | Versions |
|---|---|
| djangoproject · Django | affected 6.0 < 6.0.5 ; unaffected 6.0.5 ; affected 5.2 < 5.2.14 ; unaffected 5.2.14 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |